Project

General

Profile

Bug #2162 » 0054-savegame-Fix-Out-of-Bounds-Read-in-activities.order.patch

main, S3_3 - Marko Lindqvist, 08/24/2026 02:52 AM

View differences:

server/savegame/savegame2.c
sg_warn_ret_val(secfile_lookup_int(loading->file, &punit->fuel,
"%s.fuel", unitstr), FALSE,
"%s", secfile_error());
sg_warn_ret_val(secfile_lookup_int(loading->file, &ei,
"%s.activity", unitstr), FALSE,
"%s", secfile_error());
activity = unit_activity_by_name(loading->activities.order[ei],
fc_strcasecmp);
if (ei >= 0 && ei < loading->activities.size) {
activity = unit_activity_by_name(loading->activities.order[ei],
fc_strcasecmp);
} else {
log_sg("Invalid activity id for unit %d", punit->id);
activity = ACTIVITY_IDLE;
}
punit->birth_turn
= secfile_lookup_int_default(loading->file, game.info.turn,
server/savegame/savegame3.c
sg_warn_ret_val(secfile_lookup_int(loading->file, &punit->fuel,
"%s.fuel", unitstr), FALSE,
"%s", secfile_error());
sg_warn_ret_val(secfile_lookup_int(loading->file, &ei,
"%s.activity", unitstr), FALSE,
"%s", secfile_error());
activity = unit_activity_by_name(loading->activities.order[ei],
fc_strcasecmp);
if (ei >= 0 && ei < loading->activities.size) {
activity = unit_activity_by_name(loading->activities.order[ei],
fc_strcasecmp);
} else {
log_sg("Invalid activity id for unit %d", punit->id);
activity = ACTIVITY_IDLE;
}
sg_warn_ret_val(secfile_lookup_int(loading->file, &ei,
"%s.action", unitstr), FALSE,
"%s", secfile_error());
(1-1/2)