shithub: choc

Download patch

ref: 07109cb24fab1ecde3f2abc8220201f3da99f4e8
parent: 118d869f5b104563284ac033e156a6bb85a4d642
author: Simon Howard <[email protected]>
date: Thu Jan 4 20:36:31 EST 2018 

hexen: Add bounds checking for strings table.

ACS lumps provide a strings table but we must enforce that all lookups
into this table are properly bounds checked.


--- a/src/hexen/p_acs.c
+++ b/src/hexen/p_acs.c
@@ -909,6 +909,15 @@
     return var;
 }
 
+static char *StringLookup(int string_index)
+{
+    ACSAssert(string_index >= 0,
+              "negative string index: %d < 0", string_index);
+    ACSAssert(string_index < ACStringCount,
+              "invalid string index: %d >= %d", string_index, ACStringCount);
+    return ACStrings[string_index];
+}
+
 //==========================================================================
 //
 // P-Code Commands
@@ -1517,7 +1526,7 @@
     int flat;
     int sectorIndex;
 
-    flat = R_FlatNumForName(ACStrings[Pop()]);
+    flat = R_FlatNumForName(StringLookup(Pop()));
     tag = Pop();
     sectorIndex = -1;
     while ((sectorIndex = P_FindSectorFromTag(tag, sectorIndex)) >= 0)
@@ -1535,7 +1544,7 @@
 
     tag = LONG(*PCodePtr);
     ++PCodePtr;
-    flat = R_FlatNumForName(ACStrings[LONG(*PCodePtr)]);
+    flat = R_FlatNumForName(StringLookup(LONG(*PCodePtr)));
     ++PCodePtr;
     sectorIndex = -1;
     while ((sectorIndex = P_FindSectorFromTag(tag, sectorIndex)) >= 0)
@@ -1551,7 +1560,7 @@
     int flat;
     int sectorIndex;
 
-    flat = R_FlatNumForName(ACStrings[Pop()]);
+    flat = R_FlatNumForName(StringLookup(Pop()));
     tag = Pop();
     sectorIndex = -1;
     while ((sectorIndex = P_FindSectorFromTag(tag, sectorIndex)) >= 0)
@@ -1569,7 +1578,7 @@
 
     tag = LONG(*PCodePtr);
     ++PCodePtr;
-    flat = R_FlatNumForName(ACStrings[LONG(*PCodePtr)]);
+    flat = R_FlatNumForName(StringLookup(LONG(*PCodePtr)));
     ++PCodePtr;
     sectorIndex = -1;
     while ((sectorIndex = P_FindSectorFromTag(tag, sectorIndex)) >= 0)
@@ -1746,7 +1755,7 @@
 
 static int CmdPrintString(void)
 {
-    M_StringConcat(PrintBuffer, ACStrings[Pop()], sizeof(PrintBuffer));
+    M_StringConcat(PrintBuffer, StringLookup(Pop()), sizeof(PrintBuffer));
     return SCRIPT_CONTINUE;
 }
 
@@ -1826,7 +1835,7 @@
         mobj = (mobj_t *) & ACScript->line->frontsector->soundorg;
     }
     volume = Pop();
-    S_StartSoundAtVolume(mobj, S_GetSoundID(ACStrings[Pop()]), volume);
+    S_StartSoundAtVolume(mobj, S_GetSoundID(StringLookup(Pop())), volume);
     return SCRIPT_CONTINUE;
 }
 
@@ -1839,7 +1848,7 @@
     int searcher;
 
     volume = Pop();
-    sound = S_GetSoundID(ACStrings[Pop()]);
+    sound = S_GetSoundID(StringLookup(Pop()));
     tid = Pop();
     searcher = -1;
     while ((mobj = P_FindMobjFromTID(tid, &searcher)) != NULL)
@@ -1854,7 +1863,7 @@
     int volume;
 
     volume = Pop();
-    S_StartSoundAtVolume(NULL, S_GetSoundID(ACStrings[Pop()]), volume);
+    S_StartSoundAtVolume(NULL, S_GetSoundID(StringLookup(Pop())), volume);
     return SCRIPT_CONTINUE;
 }
 
@@ -1867,7 +1876,7 @@
     {
         mobj = (mobj_t *) & ACScript->line->frontsector->soundorg;
     }
-    SN_StartSequenceName(mobj, ACStrings[Pop()]);
+    SN_StartSequenceName(mobj, StringLookup(Pop()));
     return SCRIPT_CONTINUE;
 }
 
@@ -1880,7 +1889,7 @@
     int texture;
     int searcher;
 
-    texture = R_TextureNumForName(ACStrings[Pop()]);
+    texture = R_TextureNumForName(StringLookup(Pop()));
     position = Pop();
     side = Pop();
     lineTag = Pop();