From 32f3369481e28f97c900ed42c06f1db0d8733b1e Mon Sep 17 00:00:00 2001 From: chief1983 Date: Thu, 9 Apr 2026 13:16:05 -0500 Subject: [PATCH] Fix standalone web UI crash when polling player data before ship selection playerGet() indexed Ship_info with ship_class without bounds checking. Before ship selection, ship_class is -1, which as an unsigned index causes an out-of-bounds access. Add bounds check using ship_info_size(), matching the pattern used elsewhere in the codebase. Also update the Windows standalone GUI to use ship_info_size() for consistency. Fixes #7366 Co-Authored-By: Claude Opus 4.6 (1M context) --- code/network/stand_gui-unix.cpp | 6 +++++- code/network/stand_gui.cpp | 2 +- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/code/network/stand_gui-unix.cpp b/code/network/stand_gui-unix.cpp index b6e86768f26..e2e3c963135 100644 --- a/code/network/stand_gui-unix.cpp +++ b/code/network/stand_gui-unix.cpp @@ -457,7 +457,11 @@ json_t* playerGet(ResourceContext * /*context*/) { json_object_set(obj, "host", (MULTI_HOST(p)) ? json_true() : json_false()); json_object_set(obj, "observer", (MULTI_OBSERVER(p)) ? json_true() : json_false()); json_object_set(obj, "callsign", json_string(p.m_player->callsign)); - json_object_set(obj, "ship", json_string(Ship_info[p.p_info.ship_class].name)); + if (p.p_info.ship_class >= 0 && p.p_info.ship_class < ship_info_size()) { + json_object_set(obj, "ship", json_string(Ship_info[p.p_info.ship_class].name)); + } else { + json_object_set(obj, "ship", json_string("")); + } json_array_append(playerList, obj); } diff --git a/code/network/stand_gui.cpp b/code/network/stand_gui.cpp index 1dc21075a23..9d934984781 100644 --- a/code/network/stand_gui.cpp +++ b/code/network/stand_gui.cpp @@ -1067,7 +1067,7 @@ void std_pinfo_display_player_info(net_player *p) txt[sizeof(txt)-1] = '\0'; // set his ship type -- Cyborg17, if it's valid! - if (p->p_info.ship_class >= 0 && p->p_info.ship_class < static_cast(Ship_info.size())) { + if (p->p_info.ship_class >= 0 && p->p_info.ship_class < ship_info_size()) { SetWindowText(Player_ship_type, Ship_info[p->p_info.ship_class].name); }