Fix getBodyPartName bounds checks#5060
Open
HeresHavi wants to merge 1 commit into
Open
Conversation
Reject body part ID 10 before indexing the 10-entry name tables on both the client and server.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fix the client and server bounds checks used by
getBodyPartName. Body part IDs are now rejected before they can index past the 10-entry name tables.Motivation
The body part name tables contain 10 entries, with valid indexes from 0 to 9, but the existing checks also accepted ID 10. On the client, this reached the fixed-array bounds assertion. On the server, it read past the raw array and returned an unintended string instead of
false.For example, a client resource calling
getBodyPartName(10)could assert the player's client. The same call from a server resource could return data from outside the body part name table.The updated checks reject ID 10 before accessing either table. Valid IDs from 0 to 9 keep their existing behavior, and invalid IDs return
false.Test plan
Runtime
1.7-untested-26702, client-sidegetBodyPartName(10)triggered theuiIndex < SIZEassertion inSharedUtil.Misc.h. Server-sidegetBodyPartName(10)returned an unintended string with a length of 6 instead offalse.getBodyPartName(10)returnedfalse. No assertion, crash, or unintended server result occurred.getBodyPartName(9)returnedHead. ID 11 returnedfalse, confirming that existing rejection behavior remains unchanged.Builds and Tests
Debug | Win32: Build passed, 304 client tests passed.Release | Win32: Build passed, 304 client tests passed.Debug | x64: Server build passed.Release | x64: Server build passed.clang-format.Checklist