halflife icon indicating copy to clipboard operation
halflife copied to clipboard

Engine doesn't check for array bounds before loading wad files

Open SamVanheer opened this issue 3 years ago • 0 comments

When the engine loads wad files used by a map in TEX_InitFromWad it doesn't first check if the FileHandle_t texfiles[128] array has space left to store another file handle. As a result if a map has more than 128 wad files it will write the file handle to memory outside the array's bounds, most likely to memory belonging to the sv_areanodes global since it's located near that global in memory.

This code should be added before the FS_Open call to prevent this problem from occurring:

if (nTexFiles >= 128)
{
    Sys_Error("WARNING: couldn't open %s: too many wad files in map\n", wadPath);
}

To disambiguate this error from the existing error message used for missing files this code:

Sys_Error("WARNING: couldn't open %s\n", wadPath);

Should be changed to:

Sys_Error("WARNING: couldn't open %s: file not found\n", wadPath);

SamVanheer avatar Jan 26 '22 16:01 SamVanheer