Skip to content

DebugCrash string management is bogus #1017

Open
@xezon

Description

@xezon

Is only a theoretical issue.

void DebugCrash(const char *format, ...)
{
...
  va_list arg;
  va_start(arg, format);
  vsprintf(theCrashBuffer + strlen(theCrashBuffer), format, arg);
  va_end(arg);

  if (strlen(theCrashBuffer) >= sizeof(theCrashBuffer)) // <----- xezon: this is buffer read overflow
  {
    if (!DX8Wrapper_IsWindowed) {
      if (ApplicationHWnd) {
        ShowWindow(ApplicationHWnd, SW_HIDE);
      }
    }
    MessageBoxWrapper("String too long for debug buffers", "", MB_OK|MB_TASKMODAL);
  }
...

Metadata

Metadata

Assignees

No one assigned

    Labels

    MinorSeverity: Minor < Major < Critical < BlockerStabilityConcerns stability of the runtime

    Type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions