patchBos Wars - Patches: patch #7070, Fix buffer overflow in...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

patch #7070: Fix buffer overflow in unit->Data.Move.Path[]

Submitter:  Kalle Olavi Niemitalo <kon>
Submitted:  Thu 21 Jan 2010 08:31:47 PM UTC
   
 
Open/Closed:  Closed Status:  Done
Assigned to:  feb

Sun 28 Feb 2010 04:22:01 PM UTC, comment #2: 

Second patch applied.

Thank you for the patches.

François Beerten <feb>
Group administrator
Thu 21 Jan 2010 09:37:50 PM UTC, comment #1: 

First patch applied.

François Beerten <feb>
Group administrator
Thu 21 Jan 2010 08:31:47 PM UTC, original submission:  

When saving a game, save unit->Data.Move only if the current order seems to use that.  In particular, don't save it when the action of the current order is UnitActionDie (which doesn't use any data), nor when the unit hasn't yet started executing the current order.  This fix is incomplete in that it never saves unit->Data.Move for UnitActionResource, even though that does use it for some values of unit->SubAction; but this is not a new bug.

When loading a game, raise an error if the path data is too long to fit in unit->Data.Move.Path[].  This avoids memory corruption that could have security implications.  However, if the current action is UnitActionDie, which wouldn't use unit->Data.Move in any case, then ignore any path data so that games saved before this patch can still be loaded.

Intended to fix http://bugs.debian.org/566119

Kalle Olavi Niemitalo <kon>
Group Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by feb (Posted a comment)
  • -email is unavailable- added by kon (Submitted the item)
  •  

    Follow 6 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2010-02-28 feb Open/ClosedOpen Closed
        StatusIn Progress Done
    2010-01-21 feb StatusNone In Progress
        Assigned toNone feb
    2010-01-21 kon Attached File- Added 0001-Split-SaveOrderData-off-SaveUnit.patch, #19523
        Attached File- Added 0002-Fix-buffer-overflow-in-unit-Data.Move.Path.patch, #19524

    Back to the top

    Powered by Savane 3.13-caa5.
    Corresponding source code