Skip to content

Commit ce756df

Browse files
slurmlordslurmlord
authored
[GEN][ZH] Fix several potential buffer overruns in game code (#849)
1 parent 291382d commit ce756df

File tree

12 files changed

+19
-18
lines changed

12 files changed

+19
-18
lines changed

‎Core/Libraries/Source/WWVegas/WW3D2/dynamesh.cpp

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -587,9 +587,6 @@ DynamicMeshClass::DynamicMeshClass(const DynamicMeshClass & src) :
587587

588588
MultiVertexMaterial[pass] = src.MultiVertexMaterial[pass];
589589
VertexMaterialIdx[pass] = src.VertexMaterialIdx[pass];
590-
591-
MultiVertexColor[pass] = src.MultiVertexColor[pass];
592-
CurVertexColor[pass] = src.CurVertexColor[pass];
593590
}
594591

595592
for (int color_array_index = 0; color_array_index < MAX_COLOR_ARRAYS; color_array_index++) {

‎Core/Libraries/Source/WWVegas/WWDownload/ftp.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,7 @@ class Cftp
6767
char m_szRemoteFilePath[128];
6868
char m_szRemoteFileName[128];
6969
char m_szLocalFilePath[128];
70-
char m_szLocalFileName[128];
70+
char m_szLocalFileName[256];
7171
char m_szServerName[128];
7272
char m_szUserName[128];
7373
char m_szPassword[128];

‎Generals/Code/GameEngine/Source/Common/System/SaveGame/GameState.cpp

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -236,7 +236,7 @@ UnicodeString getUnicodeDateBuffer(SYSTEMTIME timeVal)
236236
DATE_SHORTDATE,
237237
&timeVal,
238238
NULL,
239-
dateBuffer, sizeof(dateBuffer) );
239+
dateBuffer, ARRAY_SIZE(dateBuffer) );
240240
displayDateBuffer.set(dateBuffer);
241241
return displayDateBuffer;
242242
//displayDateBuffer.format( L"%ls", dateBuffer );
@@ -270,7 +270,7 @@ UnicodeString getUnicodeTimeBuffer(SYSTEMTIME timeVal)
270270
&timeVal,
271271
NULL,
272272
timeBuffer,
273-
sizeof(timeBuffer) );
273+
ARRAY_SIZE(timeBuffer) );
274274
displayTimeBuffer.set(timeBuffer);
275275
return displayTimeBuffer;
276276
}

‎Generals/Code/GameEngine/Source/GameClient/GUI/GUICallbacks/Menus/PopupReplay.cpp

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -288,7 +288,7 @@ void reallySaveReplay(void)
288288
if(DeleteFile(filename.str()) == 0)
289289
{
290290
wchar_t buffer[1024];
291-
FormatMessageW ( FORMAT_MESSAGE_FROM_SYSTEM, NULL, GetLastError(), 0, buffer, sizeof(buffer), NULL);
291+
FormatMessageW ( FORMAT_MESSAGE_FROM_SYSTEM, NULL, GetLastError(), 0, buffer, ARRAY_SIZE(buffer), NULL);
292292
UnicodeString errorStr;
293293
errorStr.set(buffer);
294294
errorStr.trim();
@@ -313,7 +313,7 @@ void reallySaveReplay(void)
313313
if(CopyFile(oldFilename.str(),filename.str(), FALSE) == 0)
314314
{
315315
wchar_t buffer[1024];
316-
FormatMessageW( FORMAT_MESSAGE_FROM_SYSTEM, NULL, GetLastError(), 0, buffer, sizeof(buffer), NULL);
316+
FormatMessageW( FORMAT_MESSAGE_FROM_SYSTEM, NULL, GetLastError(), 0, buffer, ARRAY_SIZE(buffer), NULL);
317317
UnicodeString errorStr;
318318
errorStr.set(buffer);
319319
errorStr.trim();

‎Generals/Code/GameEngine/Source/GameClient/GUI/GUICallbacks/Menus/ReplayMenu.cpp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -672,7 +672,7 @@ void copyReplay( void )
672672
if(CopyFile(filename.str(),newFilename.str(), FALSE) == 0)
673673
{
674674
wchar_t buffer[1024];
675-
FormatMessageW( FORMAT_MESSAGE_FROM_SYSTEM, NULL, GetLastError(), 0, buffer, sizeof(buffer), NULL);
675+
FormatMessageW( FORMAT_MESSAGE_FROM_SYSTEM, NULL, GetLastError(), 0, buffer, ARRAY_SIZE(buffer), NULL);
676676
UnicodeString errorStr;
677677
errorStr.set(buffer);
678678
errorStr.trim();

‎Generals/Code/GameEngineDevice/Source/W3DDevice/GameClient/W3DMouse.cpp

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -235,9 +235,11 @@ void W3DMouse::initD3DAssets(void)
235235
for (Int j=0; j < MAX_2D_CURSOR_ANIM_FRAMES; j++)
236236
{
237237
cursorTextures[i][j]=NULL;//am->Get_Texture(m_cursorInfo[i].textureName.str());
238-
m_currentD3DSurface[i]=NULL;
239238
}
240239
}
240+
241+
for (Int x = 0; x < MAX_2D_CURSOR_ANIM_FRAMES; x++)
242+
m_currentD3DSurface[x]=NULL;
241243
}
242244
}
243245

‎Generals/Code/Libraries/Source/WWVegas/WW3D2/rinfo.cpp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -101,7 +101,7 @@ MaterialPassClass * RenderInfoClass::Peek_Additional_Pass(int i)
101101
void RenderInfoClass::Push_Override_Flags(RINFO_OVERRIDE_FLAGS flg)
102102
{
103103
// copy to the end of the array
104-
WWASSERT(OverrideFlagLevel<MAX_OVERRIDE_FLAG_LEVEL);
104+
WWASSERT(OverrideFlagLevel<MAX_OVERRIDE_FLAG_LEVEL - 1);
105105
OverrideFlagLevel++;
106106
OverrideFlag[OverrideFlagLevel]=flg;
107107
}

‎GeneralsMD/Code/GameEngine/Source/Common/System/SaveGame/GameState.cpp

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -236,7 +236,7 @@ UnicodeString getUnicodeDateBuffer(SYSTEMTIME timeVal)
236236
DATE_SHORTDATE,
237237
&timeVal,
238238
NULL,
239-
dateBuffer, sizeof(dateBuffer) );
239+
dateBuffer, ARRAY_SIZE(dateBuffer) );
240240
displayDateBuffer.set(dateBuffer);
241241
return displayDateBuffer;
242242
//displayDateBuffer.format( L"%ls", dateBuffer );
@@ -270,7 +270,7 @@ UnicodeString getUnicodeTimeBuffer(SYSTEMTIME timeVal)
270270
&timeVal,
271271
NULL,
272272
timeBuffer,
273-
sizeof(timeBuffer) );
273+
ARRAY_SIZE(timeBuffer) );
274274
displayTimeBuffer.set(timeBuffer);
275275
return displayTimeBuffer;
276276
}

‎GeneralsMD/Code/GameEngine/Source/GameClient/GUI/GUICallbacks/Menus/PopupReplay.cpp

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -288,7 +288,7 @@ void reallySaveReplay(void)
288288
if(DeleteFile(filename.str()) == 0)
289289
{
290290
wchar_t buffer[1024];
291-
FormatMessageW ( FORMAT_MESSAGE_FROM_SYSTEM, NULL, GetLastError(), 0, buffer, sizeof(buffer), NULL);
291+
FormatMessageW ( FORMAT_MESSAGE_FROM_SYSTEM, NULL, GetLastError(), 0, buffer, ARRAY_SIZE(buffer), NULL);
292292
UnicodeString errorStr;
293293
errorStr.set(buffer);
294294
errorStr.trim();
@@ -313,7 +313,7 @@ void reallySaveReplay(void)
313313
if(CopyFile(oldFilename.str(),filename.str(), FALSE) == 0)
314314
{
315315
wchar_t buffer[1024];
316-
FormatMessageW( FORMAT_MESSAGE_FROM_SYSTEM, NULL, GetLastError(), 0, buffer, sizeof(buffer), NULL);
316+
FormatMessageW( FORMAT_MESSAGE_FROM_SYSTEM, NULL, GetLastError(), 0, buffer, ARRAY_SIZE(buffer), NULL);
317317
UnicodeString errorStr;
318318
errorStr.set(buffer);
319319
errorStr.trim();

‎GeneralsMD/Code/GameEngine/Source/GameClient/GUI/GUICallbacks/Menus/ReplayMenu.cpp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -672,7 +672,7 @@ void copyReplay( void )
672672
if(CopyFile(filename.str(),newFilename.str(), FALSE) == 0)
673673
{
674674
wchar_t buffer[1024];
675-
FormatMessageW( FORMAT_MESSAGE_FROM_SYSTEM, NULL, GetLastError(), 0, buffer, sizeof(buffer), NULL);
675+
FormatMessageW( FORMAT_MESSAGE_FROM_SYSTEM, NULL, GetLastError(), 0, buffer, ARRAY_SIZE(buffer), NULL);
676676
UnicodeString errorStr;
677677
errorStr.set(buffer);
678678
errorStr.trim();

‎GeneralsMD/Code/GameEngineDevice/Source/W3DDevice/GameClient/W3DMouse.cpp

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -235,9 +235,11 @@ void W3DMouse::initD3DAssets(void)
235235
for (Int j=0; j < MAX_2D_CURSOR_ANIM_FRAMES; j++)
236236
{
237237
cursorTextures[i][j]=NULL;//am->Get_Texture(m_cursorInfo[i].textureName.str());
238-
m_currentD3DSurface[i]=NULL;
239238
}
240239
}
240+
241+
for (Int x = 0; x < MAX_2D_CURSOR_ANIM_FRAMES; x++)
242+
m_currentD3DSurface[x]=NULL;
241243
}
242244
}
243245

‎GeneralsMD/Code/Libraries/Source/WWVegas/WW3D2/rinfo.cpp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -112,7 +112,7 @@ MaterialPassClass * RenderInfoClass::Peek_Additional_Pass(int i)
112112
void RenderInfoClass::Push_Override_Flags(RINFO_OVERRIDE_FLAGS flg)
113113
{
114114
// copy to the end of the array
115-
WWASSERT(OverrideFlagLevel<MAX_OVERRIDE_FLAG_LEVEL);
115+
WWASSERT(OverrideFlagLevel<MAX_OVERRIDE_FLAG_LEVEL - 1);
116116
OverrideFlagLevel++;
117117
OverrideFlag[OverrideFlagLevel]=flg;
118118
}

0 commit comments

Comments
 (0)