Fixed a serious potential corruption bug
authorDavid Anderson <dvander@alliedmods.net>
Tue Jan 16 19:03:29 2007 +0000 (2007-01-16)
changeset 296993eb3462410
parent 295 af56b2e75be6
child 297 3ab5f87d509f
Fixed a serious potential corruption bug
core/systems/CFunction.cpp
core/systems/CFunction.h
     1.1 --- a/core/systems/CFunction.cpp	Mon Jan 15 23:10:59 2007 +0000
     1.2 +++ b/core/systems/CFunction.cpp	Tue Jan 16 19:03:29 2007 +0000
     1.3 @@ -90,7 +90,7 @@
     1.4  
     1.5  	info->flags = inarray ? copyback : 0;
     1.6  	info->marked = true;
     1.7 -	info->size = cells;
     1.8 +	info->size = cells * sizeof(cell_t);
     1.9  	m_params[m_curparam] = info->local_addr;
    1.10  	m_curparam++;
    1.11  
    1.12 @@ -162,7 +162,7 @@
    1.13  skip_localtostr:
    1.14  	info->flags = cp_flags;
    1.15  	info->orig_addr = (cell_t *)string;
    1.16 -	info->size = cells;
    1.17 +	info->size = len;
    1.18  
    1.19  	return SP_ERROR_NONE;
    1.20  }
    1.21 @@ -229,13 +229,13 @@
    1.22  		{
    1.23  			if (temp_info[numparams].orig_addr)
    1.24  			{
    1.25 -				if (temp_info[numparams].size == 1)
    1.26 +				if (temp_info[numparams].size == sizeof(cell_t))
    1.27  				{
    1.28  					*temp_info[numparams].orig_addr = *temp_info[numparams].phys_addr;
    1.29  				} else {
    1.30  					memcpy(temp_info[numparams].orig_addr, 
    1.31  							temp_info[numparams].phys_addr, 
    1.32 -							temp_info[numparams].size * sizeof(cell_t));
    1.33 +							temp_info[numparams].size);
    1.34  				}
    1.35  			}
    1.36  		}
     2.1 --- a/core/systems/CFunction.h	Mon Jan 15 23:10:59 2007 +0000
     2.2 +++ b/core/systems/CFunction.h	Tue Jan 16 19:03:29 2007 +0000
     2.3 @@ -11,7 +11,7 @@
     2.4  	cell_t local_addr;	/* Local address to free */
     2.5  	cell_t *phys_addr;	/* Physical address of our copy */
     2.6  	cell_t *orig_addr;	/* Original address to copy back to */
     2.7 -	ucell_t size;		/* Size of array in cells */
     2.8 +	ucell_t size;		/* Size of array in bytes */
     2.9  };
    2.10  
    2.11  class CPlugin;