source-sdk-2013 icon indicating copy to clipboard operation
source-sdk-2013 copied to clipboard

[tf2][client][asan] A bunch of issues found by AddressSanitizer/MSVC static analyzer in client

Open dimhotepus opened this issue 10 months ago • 0 comments

  • Out-of-bound read found by AddressSanitizer in Youtube upload dialog, CODEC_COUNT is 10, but s_Codecs length is 1 or 2: https://github.com/ValveSoftware/source-sdk-2013/blob/238a15a79dd2c3c151e98eea8b39e5f161a93703/src/game/client/replay/replayvideo.cpp#L31-L34 https://github.com/ValveSoftware/source-sdk-2013/blob/238a15a79dd2c3c151e98eea8b39e5f161a93703/src/game/client/replay/replayvideo.cpp#L50-L54 https://github.com/ValveSoftware/source-sdk-2013/blob/238a15a79dd2c3c151e98eea8b39e5f161a93703/src/game/client/replay/replayvideo.cpp#L128-L132

  • Potential out of bounds read from g_KillStreakEffectsBlue as Assert is absent in Release mode and ARRAYSIZE( g_KillStreakEffectsBase ) > ARRAYSIZE( g_KillStreakEffectsBlue (found by MSVC static analyzer): https://github.com/ValveSoftware/source-sdk-2013/blob/238a15a79dd2c3c151e98eea8b39e5f161a93703/src/game/client/tf/c_tf_player.cpp#L10286-L10296

  • Potential array pEntities underflow (iCurTranslucentEntity may become -1 - notice pEntities access first, index check second) (found by MSVC static analyzer): https://github.com/ValveSoftware/source-sdk-2013/blob/238a15a79dd2c3c151e98eea8b39e5f161a93703/src/game/client/viewrender.cpp#L4601 https://github.com/ValveSoftware/source-sdk-2013/blob/238a15a79dd2c3c151e98eea8b39e5f161a93703/src/game/client/viewrender.cpp#L4647

dimhotepus avatar Feb 26 '25 17:02 dimhotepus