halflife
halflife copied to clipboard
Engine doesn't check for array bounds before loading wad files
When the engine loads wad files used by a map in TEX_InitFromWad it doesn't first check if the FileHandle_t texfiles[128] array has space left to store another file handle. As a result if a map has more than 128 wad files it will write the file handle to memory outside the array's bounds, most likely to memory belonging to the sv_areanodes global since it's located near that global in memory.
This code should be added before the FS_Open call to prevent this problem from occurring:
if (nTexFiles >= 128)
{
Sys_Error("WARNING: couldn't open %s: too many wad files in map\n", wadPath);
}
To disambiguate this error from the existing error message used for missing files this code:
Sys_Error("WARNING: couldn't open %s\n", wadPath);
Should be changed to:
Sys_Error("WARNING: couldn't open %s: file not found\n", wadPath);