From 21f3dee5544c853350ba116c370f9bd62797ac35 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Alexandre-Xavier=20Labont=C3=A9-Lamoureux?= Date: Mon, 28 Aug 2023 19:13:02 -0400 Subject: [PATCH 1/3] Fix buffer overflow in creditsResetSlides --- src/game/credits.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/game/credits.c b/src/game/credits.c index fd4d50518..b2409b171 100644 --- a/src/game/credits.c +++ b/src/game/credits.c @@ -1079,7 +1079,7 @@ void creditsResetSlides(void) g_CreditsData->coreteammap[i + 1] = pool[index]; - while (index < NUM_CORE_TEAM - i) { + while (index < NUM_CORE_TEAM - i - 1) { pool[index] = pool[index + 1]; index++; } From c54a768b19a80d5ffc7e8c27844b6482c6f18980 Mon Sep 17 00:00:00 2001 From: fgsfds Date: Tue, 29 Aug 2023 10:09:46 +0200 Subject: [PATCH 2/3] port: fix #117 and other related OOB writes --- src/game/padhalllv.c | 12 +++++++++--- src/game/player.c | 4 ++++ src/game/training.c | 8 ++++++++ src/game/weather.c | 12 ++++++++++-- 4 files changed, 31 insertions(+), 5 deletions(-) diff --git a/src/game/padhalllv.c b/src/game/padhalllv.c index 7d55e2be9..2dca0ae16 100644 --- a/src/game/padhalllv.c +++ b/src/game/padhalllv.c @@ -76,9 +76,15 @@ void navSetSeed(u32 upper, u32 lower) struct waypoint *waypointFindClosestToPos(struct coord *pos, RoomNum *rooms) { struct waypoint *closest = NULL; +#ifdef AVOID_UB + // prevent bgRoomGetNeighbours or roomsAppend from writing out of bounds + RoomNum allrooms[31]; + RoomNum neighbours[11]; +#else RoomNum allrooms[30]; - s32 candlen = 0; RoomNum neighbours[10]; +#endif + s32 candlen = 0; s32 i; s32 j; struct waypoint *candwaypoints[10]; @@ -94,8 +100,8 @@ struct waypoint *waypointFindClosestToPos(struct coord *pos, RoomNum *rooms) allrooms[i] = -1; for (i = 0; rooms[i] != -1; i++) { - bgRoomGetNeighbours(rooms[i], neighbours, ARRAYCOUNT(neighbours)); - roomsAppend(neighbours, allrooms, ARRAYCOUNT(allrooms)); + bgRoomGetNeighbours(rooms[i], neighbours, 10); + roomsAppend(neighbours, allrooms, 30); } if (g_StageSetup.waypoints != NULL) { diff --git a/src/game/player.c b/src/game/player.c index 5e761a3d5..e5028c148 100644 --- a/src/game/player.c +++ b/src/game/player.c @@ -243,7 +243,11 @@ f32 playerChooseSpawnLocation(f32 chrradius, struct coord *dstpos, RoomNum *dstr s32 stack3[2]; RoomNum tmppadrooms[2]; f32 bestsqdist; +#ifdef AVOID_UB + RoomNum neighbours[21]; // prevent bgRoomGetNeighbours from writing out of bounds +#else RoomNum neighbours[20]; +#endif // Iterate all spawn pads and populate the category arrays for (p = 0; p < numpads; p++) { diff --git a/src/game/training.c b/src/game/training.c index bdc6f20c7..148c24912 100644 --- a/src/game/training.c +++ b/src/game/training.c @@ -1248,9 +1248,17 @@ void frEndSession(bool hidetargets) s32 j; s16 propnums[256]; s16 *propnumptr; +#ifdef AVOID_UB + RoomNum rooms[21]; +#else RoomNum rooms[20]; +#endif u32 stack1; +#ifdef AVOID_UB + RoomNum rooms2[11]; // prevent bgRoomGetNeighbours from writing out of bounds +#else RoomNum rooms2[10]; +#endif u32 stack2; if (g_FrDataLoaded) { diff --git a/src/game/weather.c b/src/game/weather.c index cc2458d89..917e4d436 100644 --- a/src/game/weather.c +++ b/src/game/weather.c @@ -856,7 +856,11 @@ Gfx *weatherRenderRain(Gfx *gdl, struct weatherdata *weather, s32 arg2) u32 stack2; struct coord distcamtobbmax; struct coord distcamtobbmin; +#ifdef AVOID_UB + RoomNum neighbours[21]; +#else RoomNum neighbours[20]; +#endif particledata = weather->particledata[arg2]; numtris = 0; @@ -1063,7 +1067,7 @@ Gfx *weatherRenderRain(Gfx *gdl, struct weatherdata *weather, s32 arg2) } for (scale = 1.0f, t = 0; t < numtestrooms; t++) { - numneighbours = bgRoomGetNeighbours(testrooms[t], neighbours, ARRAYCOUNT(neighbours)); + numneighbours = bgRoomGetNeighbours(testrooms[t], neighbours, 20); for (n = 0; n < numneighbours; n++) { if (g_Rooms[neighbours[n]].flags & ROOMFLAG_ONSCREEN) { @@ -2872,7 +2876,11 @@ Gfx *weatherRenderSnow(Gfx *gdl, struct weatherdata *weather, s32 arg2) s32 i; // 184 struct coord sp178; struct coord sp16c; +#ifdef AVOID_UB + RoomNum sp144[21]; // prevent bgRoomGetNeighbours from writing out of bounds +#else RoomNum sp144[20]; +#endif struct coord sp124; struct coord sp118; f32 f26; @@ -3003,7 +3011,7 @@ Gfx *weatherRenderSnow(Gfx *gdl, struct weatherdata *weather, s32 arg2) // 4c54 for (i = 0; i < sp1268; i++) { - numneighbours = bgRoomGetNeighbours(sp126c[i], sp144, ARRAYCOUNT(sp144)); + numneighbours = bgRoomGetNeighbours(sp126c[i], sp144, 20); for (j2 = 0; j2 < numneighbours; j2++) { a0 = true; From 00decf334734d719b48608525bb37b98594eb476 Mon Sep 17 00:00:00 2001 From: fgsfds Date: Tue, 29 Aug 2023 10:16:51 +0200 Subject: [PATCH 3/3] port: wrap previous change in #ifdef AVOID_UB --- src/game/credits.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/game/credits.c b/src/game/credits.c index b2409b171..5de55450d 100644 --- a/src/game/credits.c +++ b/src/game/credits.c @@ -1079,7 +1079,12 @@ void creditsResetSlides(void) g_CreditsData->coreteammap[i + 1] = pool[index]; +#ifdef AVOID_UB + // don't overflow `pool` while (index < NUM_CORE_TEAM - i - 1) { +#else + while (index < NUM_CORE_TEAM - i) { +#endif pool[index] = pool[index + 1]; index++; }