Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Buffer overflow in R_GenerateLookup #1679

Open
Rua opened this issue Apr 27, 2024 · 0 comments
Open

Buffer overflow in R_GenerateLookup #1679

Rua opened this issue Apr 27, 2024 · 0 comments

Comments

@Rua
Copy link

Rua commented Apr 27, 2024

Version of Chocolate Doom: current master

Concerning the following line of the R_GenerateLookup function:

colofs[x] = LONG(realpatch->columnofs[x-x1])+3;

The columnfs field of the patch_t struct is a statically sized array of length 8. But the index x-x1 is often greater than 7, so it indexes past the end of the array. This was there in the original Id source code too, apparently never caused problems?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant