Skip to content

Y
ygopro
Commit 2bfb8198 authored by Chen Bill's avatar Chen Bill Committed by GitHub
Browse files
Options

check len before memcpy in UpdateDeck (#2652)

parent d376ed0e
Hide whitespace changes
Inline Side-by-side
Showing with 4 additions and 0 deletions
gframe/single_duel.cpp
View file @ 2bfb8198
...@@ -278,6 +278,8 @@ void SingleDuel::PlayerKick(DuelPlayer* dp, unsigned char pos) { ...@@ -278,6 +278,8 @@ void SingleDuel::PlayerKick(DuelPlayer* dp, unsigned char pos) {
void SingleDuel::UpdateDeck(DuelPlayer* dp, unsigned char* pdata, int len) { void SingleDuel::UpdateDeck(DuelPlayer* dp, unsigned char* pdata, int len) {
if(dp->type > 1 || ready[dp->type]) if(dp->type > 1 || ready[dp->type])
return; return;
if (len < 8 || len > sizeof(CTOS_DeckData))
return;
bool valid = true; bool valid = true;
CTOS_DeckData deckbuf; CTOS_DeckData deckbuf;
std::memcpy(&deckbuf, pdata, len); std::memcpy(&deckbuf, pdata, len);
......
gframe/tag_duel.cpp
View file @ 2bfb8198
...@@ -261,6 +261,8 @@ void TagDuel::PlayerKick(DuelPlayer* dp, unsigned char pos) { ...@@ -261,6 +261,8 @@ void TagDuel::PlayerKick(DuelPlayer* dp, unsigned char pos) {
void TagDuel::UpdateDeck(DuelPlayer* dp, unsigned char* pdata, int len) { void TagDuel::UpdateDeck(DuelPlayer* dp, unsigned char* pdata, int len) {
if(dp->type > 3 || ready[dp->type]) if(dp->type > 3 || ready[dp->type])
return; return;
if (len < 8 || len > sizeof(CTOS_DeckData))
return;
bool valid = true; bool valid = true;
CTOS_DeckData deckbuf; CTOS_DeckData deckbuf;
std::memcpy(&deckbuf, pdata, len); std::memcpy(&deckbuf, pdata, len);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment