Skip to content

winrl: validate coordinates and message window access #95

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
j-lojek wants to merge 1 commit into from
Closed

winrl: validate coordinates and message window access #95

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
61 changes: 43 additions & 18 deletions win/rl/winrl.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -208,6 +208,7 @@ class NetHackRL
void store_mapped_glyph(int ch, int color, int special, XCHAR_P x,
XCHAR_P y);
void store_screen_description(XCHAR_P x, XCHAR_P y, int glyph);
static bool try_screen_offset(XCHAR_P x, XCHAR_P y, size_t *offset);

void fill_obs(nle_obs *);
int getch_method();
Expand Down Expand Up @@ -336,19 +337,30 @@ NetHackRL::fill_obs(nle_obs *obs)
// TODO: This doesn't show anything in situations where there's too
// many items at one tile, which will get displayed in a new window.

bool copied = false;
if (in_yn_function) {
// Special case. See tty_putstr: yn_function doesn't add to
// toplines until after that frame is over. Use last string on
// NHW_MESSAGE instead.
assert(windows_.size() > WIN_MESSAGE);
rl_window *win = windows_[WIN_MESSAGE].get();
assert(win->type == NHW_MESSAGE);
std::strncpy((char *) &obs->message[0],
win->strings.back().c_str(), NLE_MESSAGE_SIZE);
} else if (ttyDisplay->toplin) {
if (windows_.size() > WIN_MESSAGE) {
rl_window *win = windows_[WIN_MESSAGE].get();
if (win && win->type == NHW_MESSAGE
&& !win->strings.empty()) {
std::strncpy((char *) &obs->message[0],
win->strings.back().c_str(),
NLE_MESSAGE_SIZE);
copied = true;
}
}
}
if (!copied && ttyDisplay->toplin) {
// Copy toplines[], see topl.c.
std::strncpy((char *) &obs->message[0], toplines,
NLE_MESSAGE_SIZE);
copied = true;
}
if (copied) {
obs->message[NLE_MESSAGE_SIZE - 1] = 0;
} else {
std::memset(obs->message, 0, NLE_MESSAGE_SIZE);
}
Expand Down Expand Up @@ -461,13 +473,26 @@ NetHackRL::update_inventory_method()
}
}

bool
NetHackRL::try_screen_offset(XCHAR_P x, XCHAR_P y, size_t *offset)
{
if (x < 1 || x >= COLNO || y < 0 || y >= ROWNO) {
return false;
}

size_t i = static_cast<size_t>(x - 1);
size_t j = static_cast<size_t>(y);
*offset = j * (COLNO - 1) + i;
return true;
}

void
NetHackRL::store_glyph(XCHAR_P x, XCHAR_P y, int glyph)
{
// 1 <= x < cols, 0 <= y < rows (!)
size_t i = (x - 1) % (COLNO - 1);
size_t j = y % ROWNO;
size_t offset = j * (COLNO - 1) + i;
size_t offset;
if (!try_screen_offset(x, y, &offset)) {
return;
}

// TODO: Glyphs might be taken from gbuf[y][x].glyph.
glyphs_[offset] = shuffled_glyph(glyph);
Expand All @@ -477,10 +502,10 @@ void
NetHackRL::store_mapped_glyph(int ch, int color, int special, XCHAR_P x,
XCHAR_P y)
{
// 1 <= x < cols, 0 <= y < rows (!)
size_t i = (x - 1) % (COLNO - 1);
size_t j = y % ROWNO;
size_t offset = j * (COLNO - 1) + i;
size_t offset;
if (!try_screen_offset(x, y, &offset)) {
return;
}

chars_[offset] = ch;
colors_[offset] = color;
Expand All @@ -490,10 +515,10 @@ NetHackRL::store_mapped_glyph(int ch, int color, int special, XCHAR_P x,
void
NetHackRL::store_screen_description(XCHAR_P x, XCHAR_P y, int glyph)
{
// 1 <= x < cols, 0 <= y < rows (!)
size_t i = (x - 1) % (COLNO - 1);
size_t j = y % ROWNO;
size_t offset = j * (COLNO - 1) + i;
size_t offset;
if (!try_screen_offset(x, y, &offset)) {
return;
}
size_t start = offset * NLE_SCREEN_DESCRIPTION_LENGTH;

// see code in src/do_name.c:538 auto_describe
Expand Down
Loading