From 9ed64e084878a833d74371f46a7608317ebfa8d4 Mon Sep 17 00:00:00 2001 From: Marko Lindqvist Date: Tue, 25 Aug 2026 03:38:06 +0300 Subject: [PATCH 2/2] savegame: Fix Heap Buffer Overflow in worklist_load() Reported by Tristan See RM #2161 Signed-off-by: Marko Lindqvist --- server/savegame2.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/server/savegame2.c b/server/savegame2.c index 79a9c739dc..eb79f93851 100644 --- a/server/savegame2.c +++ b/server/savegame2.c @@ -1064,6 +1064,11 @@ static void worklist_load(struct section_file *file, struct worklist *pwl, worklist_init(pwl); pwl->length = secfile_lookup_int_default(file, 0, "%s.wl_length", path_str); + if (pwl->length > MAX_LEN_WORKLIST) { + log_sg("worklist length %d, while max worklist length %d.", + pwl->length, MAX_LEN_WORKLIST); + pwl->length = MAX_LEN_WORKLIST; + } for (i = 0; i < pwl->length; i++) { kind = secfile_lookup_str(file, "%s.wl_kind%d", path_str, i); -- 2.53.0