Bug #2161 » 0053-savegame-Fix-Heap-Buffer-Overflow-in-worklist_load.patch
| server/savegame/savegame2.c | ||
|---|---|---|
|
worklist_init(pwl);
|
||
|
pwl->length = secfile_lookup_int_default(file, 0,
|
||
|
"%s.wl_length", path_str);
|
||
|
if (pwl->length > wlist_max_length) {
|
||
|
log_sg("worklist length %d, while player's max worklist length %d.",
|
||
|
pwl->length, wlist_max_length);
|
||
|
pwl->length = wlist_max_length;
|
||
|
}
|
||
|
for (i = 0; i < pwl->length; i++) {
|
||
|
kind = secfile_lookup_str(file, "%s.wl_kind%d", path_str, i);
|
||
| ... | ... | |
|
wlist_max_length = secfile_lookup_int_default(loading->file, 0,
|
||
|
"player%d.wl_max_length",
|
||
|
plrno);
|
||
|
if (wlist_max_length > MAX_LEN_WORKLIST) {
|
||
|
log_sg("wlist_max_length %d over MAX_LEN_WORKLIST (%d)",
|
||
|
wlist_max_length, MAX_LEN_WORKLIST);
|
||
|
wlist_max_length = MAX_LEN_WORKLIST;
|
||
|
}
|
||
|
/* Load all cities of the player. */
|
||
|
for (i = 0; i < ncities; i++) {
|
||
| server/savegame/savegame3.c | ||
|---|---|---|
|
worklist_init(pwl);
|
||
|
pwl->length = secfile_lookup_int_default(file, 0,
|
||
|
"%s.wl_length", path_str);
|
||
|
if (pwl->length > wlist_max_length) {
|
||
|
log_sg("worklist length %d, while player's max worklist length %d.",
|
||
|
pwl->length, wlist_max_length);
|
||
|
pwl->length = wlist_max_length;
|
||
|
}
|
||
|
for (i = 0; i < pwl->length; i++) {
|
||
|
kind = secfile_lookup_str(file, "%s.wl_kind%d", path_str, i);
|
||
| ... | ... | |
|
wlist_max_length = secfile_lookup_int_default(loading->file, 0,
|
||
|
"player%d.wl_max_length",
|
||
|
plrno);
|
||
|
if (wlist_max_length > MAX_LEN_WORKLIST) {
|
||
|
log_sg("wlist_max_length %d over MAX_LEN_WORKLIST (%d)",
|
||
|
wlist_max_length, MAX_LEN_WORKLIST);
|
||
|
wlist_max_length = MAX_LEN_WORKLIST;
|
||
|
}
|
||
|
routes_max = secfile_lookup_int_default(loading->file, 0,
|
||
|
"player%d.routes_max_length", plrno);
|
||