Skip to content

Commit 6d260c7

Browse files
committed
fix(zscript): handle out of bounds for Game->LItems[]
This fixes a crash in Panolpy when reading a specific sign.
1 parent 07dfbbe commit 6d260c7

File tree

1 file changed

+19
-5
lines changed

1 file changed

+19
-5
lines changed

src/zc/ffscript.cpp

Lines changed: 19 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -7893,7 +7893,7 @@ int32_t get_register(const int32_t arg)
78937893
if ( indx < 0 || indx > 31 )
78947894
{
78957895
ret = -10000;
7896-
Z_scripterrlog("Invalud index used to access Game->Misc: %d\n", indx);
7896+
Z_scripterrlog("Invalid index used to access Game->Misc: %d\n", indx);
78977897
}
78987898
else
78997899
{
@@ -7913,14 +7913,23 @@ int32_t get_register(const int32_t arg)
79137913
int32_t inx = (ri->d[rINDEX])/10000;
79147914
if ( (unsigned) inx > (susptLAST-1) )
79157915
{
7916-
Z_scripterrlog("Invalid array index [%d] passed to Gme->Suspend[]\n");
7916+
Z_scripterrlog("Invalid array index [%d] passed to Game->Suspend[]\n");
79177917
}
79187918
ret = (( FFCore.system_suspend[inx] ) ? 10000 : 0);
79197919
break;
79207920
}
79217921
case GAMELITEMSD:
7922-
ret=game->lvlitems[(ri->d[rINDEX])/10000]*10000;
7922+
{
7923+
size_t index = ri->d[rINDEX] / 10000;
7924+
if (index >= game->lvlitems.size())
7925+
{
7926+
ret = 0;
7927+
Z_scripterrlog("Invalid array index [%d] passed to Game->LItems[]\n", index);
7928+
break;
7929+
}
7930+
ret=game->lvlitems[index]*10000;
79237931
break;
7932+
}
79247933
case GAMELSWITCH:
79257934
{
79267935
int32_t ind = (ri->d[rINDEX])/10000;
@@ -20877,15 +20886,20 @@ void set_register(int32_t arg, int32_t value)
2087720886
int32_t inx = (ri->d[rINDEX])/10000;
2087820887
if ( (unsigned) inx > (susptLAST-1) )
2087920888
{
20880-
Z_scripterrlog("Invalid array index [%d] passed to Gme->Suspend[]\n");
20889+
Z_scripterrlog("Invalid array index [%d] passed to Game->Suspend[]\n");
20890+
break;
2088120891
}
2088220892
FFCore.system_suspend[inx]= ( (value) ? 1 : 0 );
2088320893
break;
2088420894
}
2088520895

2088620896
case GAMELITEMSD:
20887-
game->lvlitems[(ri->d[rINDEX])/10000]=value/10000;
20897+
{
20898+
int32_t ind = (ri->d[rINDEX])/10000;
20899+
if(unsigned(ind) < MAXLEVELS)
20900+
game->lvlitems[ind]=value/10000;
2088820901
break;
20902+
}
2088920903
case GAMELSWITCH:
2089020904
{
2089120905
int32_t ind = (ri->d[rINDEX])/10000;

0 commit comments

Comments
 (0)