add boundary check to network buffer (#2517)

* fix warning

* add boundary check to network buffer

* update submodule

gframe/CGUITTFont.cpp

@@ -79,9 +79,9 @@ video::IImage* SGUITTGlyph::createGlyphImage(const FT_Bitmap& bits, video::IVide
 		const u32 image_pitch = image->getPitch() / sizeof(u16);
 		u16* image_data = (u16*)image->lock();
 		u8* glyph_data = bits.buffer;
-		for (s32 y = 0; y < bits.rows; ++y) {
+		for (s32 y = 0; y < (s32)bits.rows; ++y) {
 			u16* row = image_data;
-			for (s32 x = 0; x < bits.width; ++x) {
+			for (s32 x = 0; x < (s32)bits.width; ++x) {
 				// Monochrome bitmaps store 8 pixels per byte.  The left-most pixel is the bit 0x80.
 				// So, we go through the data each bit at a time.
 				if ((glyph_data[y * bits.pitch + (x / 8)] & (0x80 >> (x % 8))) != 0)
@@ -105,9 +105,9 @@ video::IImage* SGUITTGlyph::createGlyphImage(const FT_Bitmap& bits, video::IVide
 		const u32 image_pitch = image->getPitch() / sizeof(u32);
 		u32* image_data = (u32*)image->lock();
 		u8* glyph_data = bits.buffer;
-		for (s32 y = 0; y < bits.rows; ++y) {
+		for (s32 y = 0; y < (s32)bits.rows; ++y) {
 			u8* row = glyph_data;
-			for (s32 x = 0; x < bits.width; ++x) {
+			for (s32 x = 0; x < (s32)bits.width; ++x) {
 				image_data[y * image_pitch + x] |= static_cast<u32>(255.0f * (static_cast<float>(*row++) / gray_count)) << 24;
 				//data[y * image_pitch + x] |= ((u32)(*bitsdata++) << 24);
 			}
@@ -154,8 +154,8 @@ void SGUITTGlyph::preload(u32 char_index, FT_Face face, video::IVideoDriver* dri
 
 	glyph_page = parent->getLastGlyphPageIndex();
 	u32 texture_side_length = page->texture_size.Width - font_size;
-	u32 margin = font_size * 0.5;
-	u32 sprite_size = font_size * 1.5;
+	u32 margin = (u32)(font_size * 0.5);
+	u32 sprite_size = (u32)(font_size * 1.5);
 	core::vector2di page_position(
 		(s32)(page->used_slots % (s32)(texture_side_length / sprite_size)) * sprite_size + margin,
 		(s32)(page->used_slots / (s32)(texture_side_length / sprite_size)) * sprite_size + margin

gframe/drawing.cpp

@@ -1197,10 +1197,10 @@ void Game::DrawDeckBd() {
 		dx = 436.0f / (lx - 1);
 	}
 	int padding = scrPackCards->getPos() * lx;
-	for(size_t i = 0; i < mainsize - padding && i < 7 * lx; ++i) {
-		size_t j = i + padding;
+	for(int i = 0; i < mainsize - padding && i < 7 * lx; ++i) {
+		int j = i + padding;
 		DrawThumb(deckManager.current_deck.main[j], position2di(314 + (i % lx) * dx, 164 + (i / lx) * dy), deckBuilder.filterList);
-		if(deckBuilder.hovered_pos == 1 && deckBuilder.hovered_seq == (int)j)
+		if(deckBuilder.hovered_pos == 1 && deckBuilder.hovered_seq == j)
 			driver->draw2DRectangleOutline(Resize(313 + (i % lx) * dx, 163 + (i / lx) * dy, 359 + (i % lx) * dx, 228 + (i / lx) * dy));
 	}
 	if(!deckBuilder.showing_pack) {

gframe/duelclient.cpp

@@ -19,8 +19,8 @@ unsigned char DuelClient::selftype = 0;
 bool DuelClient::is_host = false;
 event_base* DuelClient::client_base = 0;
 bufferevent* DuelClient::client_bev = 0;
-unsigned char DuelClient::duel_client_read[0x2000];
-unsigned char DuelClient::duel_client_write[0x2000];
+unsigned char DuelClient::duel_client_read[SIZE_NETWORK_BUFFER];
+unsigned char DuelClient::duel_client_write[SIZE_NETWORK_BUFFER];
 bool DuelClient::is_closing = false;
 bool DuelClient::is_swapping = false;
 int DuelClient::select_hint = 0;

gframe/duelclient.h

@@ -27,8 +27,8 @@ private:
 	static bool is_host;
 	static event_base* client_base;
 	static bufferevent* client_bev;
-	static unsigned char duel_client_read[0x2000];
-	static unsigned char duel_client_write[0x2000];
+	static unsigned char duel_client_read[SIZE_NETWORK_BUFFER];
+	static unsigned char duel_client_write[SIZE_NETWORK_BUFFER];
 	static bool is_closing;
 	static bool is_swapping;
 	static int select_hint;
@@ -60,17 +60,25 @@ public:
 	template<typename ST>
 	static void SendPacketToServer(unsigned char proto, ST& st) {
 		auto p = duel_client_write;
-		BufferIO::WriteInt16(p, 1 + sizeof(ST));
+		int blen = sizeof(ST);
+		if (blen > MAX_DATA_SIZE)
+			blen = MAX_DATA_SIZE;
+		BufferIO::WriteInt16(p, (short)(1 + blen));
 		BufferIO::WriteInt8(p, proto);
-		memcpy(p, &st, sizeof(ST));
-		bufferevent_write(client_bev, duel_client_write, sizeof(ST) + 3);
+		memcpy(p, &st, blen);
+		bufferevent_write(client_bev, duel_client_write, blen + 3);
 	}
 	static void SendBufferToServer(unsigned char proto, void* buffer, size_t len) {
 		auto p = duel_client_write;
-		BufferIO::WriteInt16(p, 1 + len);
+		int blen = len;
+		if (blen < 0)
+			return;
+		if (blen > MAX_DATA_SIZE)
+			blen = MAX_DATA_SIZE;
+		BufferIO::WriteInt16(p, (short)(1 + blen));
 		BufferIO::WriteInt8(p, proto);
-		memcpy(p, buffer, len);
-		bufferevent_write(client_bev, duel_client_write, len + 3);
+		memcpy(p, buffer, blen);
+		bufferevent_write(client_bev, duel_client_write, blen + 3);
 	}
 	
 protected:

gframe/netserver.cpp

@@ -9,8 +9,8 @@ event_base* NetServer::net_evbase = 0;
 event* NetServer::broadcast_ev = 0;
 evconnlistener* NetServer::listener = 0;
 DuelMode* NetServer::duel_mode = 0;
-unsigned char NetServer::net_server_read[0x2000];
-unsigned char NetServer::net_server_write[0x2000];
+unsigned char NetServer::net_server_read[SIZE_NETWORK_BUFFER];
+unsigned char NetServer::net_server_write[SIZE_NETWORK_BUFFER];
 unsigned short NetServer::last_sent = 0;
 
 bool NetServer::StartServer(unsigned short port) {

gframe/netserver.h

@@ -18,8 +18,8 @@ private:
 	static event* broadcast_ev;
 	static evconnlistener* listener;
 	static DuelMode* duel_mode;
-	static unsigned char net_server_read[0x2000];
-	static unsigned char net_server_write[0x2000];
+	static unsigned char net_server_read[SIZE_NETWORK_BUFFER];
+	static unsigned char net_server_write[SIZE_NETWORK_BUFFER];
 	static unsigned short last_sent;
 
 public:
@@ -43,26 +43,34 @@ public:
 		last_sent = 3;
 		if(!dp)
 			return;
-		bufferevent_write(dp->bev, net_server_write, last_sent);
+		bufferevent_write(dp->bev, net_server_write, 3);
 	}
 	template<typename ST>
 	static void SendPacketToPlayer(DuelPlayer* dp, unsigned char proto, ST& st) {
 		auto p = net_server_write;
-		BufferIO::WriteInt16(p, 1 + sizeof(ST));
+		int blen = sizeof(ST);
+		if (blen > MAX_DATA_SIZE)
+			blen = MAX_DATA_SIZE;
+		BufferIO::WriteInt16(p, (short)(1 + blen));
 		BufferIO::WriteInt8(p, proto);
-		memcpy(p, &st, sizeof(ST));
-		last_sent = sizeof(ST) + 3;
-		if(dp)
-			bufferevent_write(dp->bev, net_server_write, last_sent);
+		memcpy(p, &st, blen);
+		last_sent = blen + 3;
+		if (dp)
+			bufferevent_write(dp->bev, net_server_write, blen + 3);
 	}
 	static void SendBufferToPlayer(DuelPlayer* dp, unsigned char proto, void* buffer, size_t len) {
 		auto p = net_server_write;
-		BufferIO::WriteInt16(p, 1 + len);
+		int blen = len;
+		if (blen < 0)
+			return;
+		if (blen > MAX_DATA_SIZE)
+			blen = MAX_DATA_SIZE;
+		BufferIO::WriteInt16(p, (short)(1 + blen));
 		BufferIO::WriteInt8(p, proto);
-		memcpy(p, buffer, len);
-		last_sent = len + 3;
-		if(dp)
-			bufferevent_write(dp->bev, net_server_write, last_sent);
+		memcpy(p, buffer, blen);
+		last_sent = blen + 3;
+		if (dp)
+			bufferevent_write(dp->bev, net_server_write, blen + 3);
 	}
 	static void ReSendToPlayer(DuelPlayer* dp) {
 		if(dp)

gframe/network.h

@@ -10,6 +10,8 @@
 #include <event2/thread.h>
 
 namespace ygo {
+	constexpr int SIZE_NETWORK_BUFFER = 0x2000;
+	constexpr int MAX_DATA_SIZE = SIZE_NETWORK_BUFFER - 3;
 
 struct HostInfo {
 	unsigned int lflist{ 0 };

gframe/single_mode.cpp

@@ -55,7 +55,7 @@ int SingleMode::SinglePlayThread() {
 	if(mainGame->chkSinglePlayReturnDeckTop->isChecked())
 		opt |= DUEL_RETURN_DECK_TOP;
 	char filename[256];
-	size_t slen = 0;
+	int slen = 0;
 	if(open_file) {
 		open_file = false;
 		slen = BufferIO::EncodeUTF8(open_file_name, filename);

ocgcore @ a04fddec

-Subproject commit 06b41f47d45c6a9b00882aeff21d4e8f380b7bba
+Subproject commit a04fddec1f78f6e8f18fb5d7d5681e67e4054dbf

script @ a36b4d20

-Subproject commit 78e2d6bc30f435724338a3727aff2e4bd9d7b3c8
+Subproject commit a36b4d2096131605246d3c37f52aeab07175304b