mirror/openmw-tes3mp
1
0
Fork 1
mirror of https://github.com/TES3MP/openmw-tes3mp.git synced 2025-01-21 11:23:51 +00:00
Code Issues Releases Wiki Activity

Merge pull request #2598 from akortunov/coverity

Browse source 
Validate input bindings to avoid crashes in OICS
This commit is contained in:
Alexei Dobrohotov 2019-11-18 01:29:05 +03:00 committed by GitHub
commit a6ffaaa434
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 26 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

33
extern/oics/ICSInputControlSystem.cpp vendored
View file

@ -97,6 +97,13 @@ namespace ICS
xmlControl = xmlControl->NextSiblingElement("Control"); xmlControl = xmlControl->NextSiblingElement("Control");
} }
static const size_t channelsCountLimit = 65536;
if (controlChannelCount > channelsCountLimit)
{
ICS_LOG("Warning: requested channels count (" + ToString<size_t>(controlChannelCount) + ") exceeds allowed maximum (" + ToString<size_t>(channelsCountLimit) + "), clamping it");
controlChannelCount = channelsCountLimit;
}
if(controlChannelCount > channelCount) if(controlChannelCount > channelCount)
{ {
size_t dif = controlChannelCount - channelCount; size_t dif = controlChannelCount - channelCount;
@ -116,7 +123,13 @@ namespace ICS
TiXmlElement* xmlChannelFilter = xmlRoot->FirstChildElement("ChannelFilter"); TiXmlElement* xmlChannelFilter = xmlRoot->FirstChildElement("ChannelFilter");
while(xmlChannelFilter) while(xmlChannelFilter)
{ {
int ch = FromString<int>(xmlChannelFilter->Attribute("number")); size_t ch = FromString<size_t>(xmlChannelFilter->Attribute("number"));
if(ch >= controlChannelCount)
{
ICS_LOG("ERROR: channel number (ch) is out of range");
xmlChannelFilter = xmlChannelFilter->NextSiblingElement("ChannelFilter");
continue;
}
TiXmlElement* xmlInterval = xmlChannelFilter->FirstChildElement("Interval"); TiXmlElement* xmlInterval = xmlChannelFilter->FirstChildElement("Interval");
while(xmlInterval) while(xmlInterval)
@ -150,7 +163,6 @@ namespace ICS
xmlInterval = xmlInterval->NextSiblingElement("Interval"); xmlInterval = xmlInterval->NextSiblingElement("Interval");
} }
xmlChannelFilter = xmlChannelFilter->NextSiblingElement("ChannelFilter"); xmlChannelFilter = xmlChannelFilter->NextSiblingElement("ChannelFilter");
} }
@ -264,14 +276,21 @@ namespace ICS
} }
} }
int chNumber = FromString<int>(xmlChannel->Attribute("number")); size_t chNumber = FromString<size_t>(xmlChannel->Attribute("number"));
if(std::string(xmlChannel->Attribute("direction")) == "DIRECT") if(chNumber >= controlChannelCount)
{ {
mControls.back()->attachChannel(mChannels[ chNumber ],Channel::DIRECT, percentage); ICS_LOG("ERROR: channel number (chNumber) is out of range");
} }
else if(std::string(xmlChannel->Attribute("direction")) == "INVERSE") else
{ {
mControls.back()->attachChannel(mChannels[ chNumber ],Channel::INVERSE, percentage); if(std::string(xmlChannel->Attribute("direction")) == "DIRECT")
{
mControls.back()->attachChannel(mChannels[ chNumber ],Channel::DIRECT, percentage);
}
else if(std::string(xmlChannel->Attribute("direction")) == "INVERSE")
{
mControls.back()->attachChannel(mChannels[ chNumber ],Channel::INVERSE, percentage);
}
} }
xmlChannel = xmlChannel->NextSiblingElement("Channel"); xmlChannel = xmlChannel->NextSiblingElement("Channel");