shithub: choc

Info  •  Files  •  Log  •  Branches

hexen: Validate strings during header parsing.

Strings must be terminated with a NUL before the end of the lump is
reached; if not they are invalid. Check that this really is the case.

--- a/src/hexen/p_acs.c

+++ b/src/hexen/p_acs.c

@@ -447,7 +447,7 @@

 void P_LoadACScripts(int lump)

 {

-    int i;

+    int i, offset;

     acsHeader_t *header;

     acsInfo_t *info;

@@ -500,7 +500,10 @@

     for (i=0; i<ACStringCount; ++i)

     {

-        ACStrings[i] = (char *) ActionCodeBase + ReadOffset();

+        offset = ReadOffset();

+        ACStrings[i] = (char *) ActionCodeBase + offset;

+        ACSAssert(memchr(ACStrings[i], '\0', ActionCodeSize - offset) != NULL,

+                  "string %d missing terminating NUL", i);

     }

     memset(MapVars, 0, sizeof(MapVars));