Skip to content

info: Fix off-by-one in R_InitSpriteDefs#5

Open
pimzero wants to merge 1 commit intomasterfrom
pim/sprnames-off-by-one
Open

info: Fix off-by-one in R_InitSpriteDefs#5
pimzero wants to merge 1 commit intomasterfrom
pim/sprnames-off-by-one

Conversation

@pimzero
Copy link
Copy Markdown
Member

@pimzero pimzero commented Aug 25, 2024

According to its documentation, R_InitSpriteDefs expects a NULL terminated list of sprites names (namelist). By looking at the code it indeed get the length fo this list by looking for a NULL pointer.

By looking at the callgraph, we can see that namelist is a pointer to sprnames. However, sprnames is not a NULL-terminated list. Until today we were lucky to have a 0 soon after sprnames (in my case, I had the value 1, followed by a 0, so it was accessing invalid data)

Let's add some room in sprnames for this NULL pointer.

Found with https://github.com/lse/ref-k/pull/87

According to its documentation, `R_InitSpriteDefs` expects a NULL
terminated list of sprites names (`namelist`). By looking at the code it
indeed get the length fo this list by looking for a NULL pointer.

By looking at the callgraph, we can see that `namelist` is a pointer to
`sprnames`. However, `sprnames` is not a NULL-terminated list. Until
today we were lucky to have a 0 soon after `sprnames` (in my
case, I had the value `1`, followed by a `0`, so it was accessing
invalid data)

Let's add some room in `sprnames` for this NULL pointer.
Copy link
Copy Markdown
Contributor

@xdbob xdbob left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nice but how tf, the OG linux-doom was not segfaulting ?

@pimzero
Copy link
Copy Markdown
Member Author

pimzero commented Aug 26, 2024

My understanding is the following:

in linux doom:

  • srpnames is not null-terminated in linux doom
  • the next symbol in the data section is states, because it is just after sprnames in the source code
  • the first entry of states is 8 bytes of 0, which, by accident or evil smartness, terminates the sprnames array

In kdoom: we build with --fdata-sections, the linker is well within its right to move things around - anything could have been deref. IMO we were just lucky to not hit this before.

I didn't manage to run linuxdoom so I can't try to replicate this behaviour on linux

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants