[FIX] RealNumber HBO

[Kuqsal 241]

Fix

 

 

item_manager.cpp

Search:

int ITEM_MANAGER::RealNumber(DWORD vnum)
{
	int bot, top, mid;

	bot = 0;
	top = m_vec_prototype.size();

	TItemTable * pTable = &m_vec_prototype[0];

	while (1)
	{
		mid = (bot + top) >> 1;

		if ((pTable + mid)->dwVnum == vnum)
			return (mid);

		if (bot >= top)
			return (-1);

		if ((pTable + mid)->dwVnum > vnum)
			top = mid - 1;
		else
			bot = mid + 1;
	}
}


//Chance:

int ITEM_MANAGER::RealNumber(DWORD vnum)
{
	if (m_vec_prototype.empty())
		return -1;

	int bot = 0;
	int top = m_vec_prototype.size() - 1;
	TItemTable * pTable = &m_vec_prototype[0];

	while (bot <= top)
	{
		int mid = (bot + top) >> 1;

		if (pTable[mid].dwVnum == vnum)
			return mid;

		if (pTable[mid].dwVnum > vnum)
			top = mid - 1;
		else
			bot = mid + 1;
	}

	return -1;
}

==53198==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x2d001758 at pc 0x00ab8378 bp 0xffbfa080 sp 0xffbfa078
READ of size 4 at 0x2d001758 thread T0
    #0 0x00ab8377 in ITEM_MANAGER::RealNumber(unsigned int) /usr/test/GameSource/Server/game/src/item_manager.cpp:645:23
    #1 0x00ab8377 in ITEM_MANAGER::GetTable(unsigned int) /usr/test/GameSource/Server/game/src/item_manager.cpp:612:13
    #2 0x00862670 in CHARACTER::RefreshGift() /usr/test/GameSource/Server/game/src/char.cpp:5696:61
    #3 0x00861ae9 in gift_refresh_event(boost::intrusive_ptr<event>, long) /usr/test/GameSource/Server/game/src/char.cpp:5556:6
    #4 0x00a0c6d0 in event_process(int) /usr/test/GameSource/Server/game/src/event.cpp:143:15
    #5 0x00cb1159 in heartbeat(std::__1::unique_ptr<heart, std::__1::default_delete<heart>>&, int) /usr/test/GameSource/Server/game/src/main.cpp:257:23
    #6 0x00cb6123 in idle() /usr/test/GameSource/Server/game/src/main.cpp:917:3
    #7 0x00cb36d4 in main /usr/test/GameSource/Server/game/src/main.cpp:567:9
    #8 0x214bd494 in __libc_start1 /usr/src/lib/libc/csu/libc_start1.c:157:7
    #9 0x00733637 in _start /usr/src/lib/csu/i386/crt1_s.S:84

0x2d001758 is located 168 bytes before 1216656-byte region [0x2d001800,0x2d12a890)
allocated by thread T0 here:
    #0 0x007d36b7 in operator new(unsigned int) /usr/src/contrib/llvm-project/compiler-rt/lib/asan/asan_new_delete.cpp:86:3
    #1 0x00ac79c3 in void* std::__1::__libcpp_operator_new[abi:se190107]<unsigned int>(unsigned int) /usr/include/c++/v1/new:265:10
    #2 0x00ac79c3 in std::__1::__libcpp_allocate[abi:se190107](unsigned int, unsigned int) /usr/include/c++/v1/new:289:10
    #3 0x00ac79c3 in std::__1::allocator<SItemTable>::allocate[abi:se190107](unsigned int) /usr/include/c++/v1/__memory/allocator.h:118:32
    #4 0x00ac79c3 in std::__1::__allocation_result<std::__1::allocator_traits<std::__1::allocator<SItemTable>>::pointer> std::__1::__allocate_at_least[abi:se190107]<std::__1::allocator<SItemTable>>(std::__1::allocator<SItemTable>&, unsigned int) /usr/include/c++/v1/__memory/allocate_at_least.h:41:19
    #5 0x00ac79c3 in std::__1::__split_buffer<SItemTable, std::__1::allocator<SItemTable>&>::__split_buffer(unsigned int, unsigned int, std::__1::allocator<SItemTable>&) /usr/include/c++/v1/__split_buffer:353:25
    #6 0x00ac79c3 in std::__1::vector<SItemTable, std::__1::allocator<SItemTable>>::__append(unsigned int) /usr/include/c++/v1/vector:1171:49
    #7 0x00ab64b0 in std::__1::vector<SItemTable, std::__1::allocator<SItemTable>>::resize(unsigned int) /usr/include/c++/v1/vector:1796:11
    #8 0x00ab64b0 in ITEM_MANAGER::Initialize(SItemTable*, int) /usr/test/GameSource/Server/game/src/item_manager.cpp:71:18
    #9 0x00a69a73 in CInputDB::Boot(char const*) /usr/test/GameSource/Server/game/src/input_db.cpp:782:28
    #10 0x00a75ca3 in CInputDB::Analyze(DESC*, unsigned char, char const*) /usr/test/GameSource/Server/game/src/input_db.cpp:2580:3
    #11 0x00a77c26 in CInputDB::Process(DESC*, void const*, int, int&) /usr/test/GameSource/Server/game/src/input_db.cpp:3032:7
    #12 0x009dd314 in DESC::ProcessInput() /usr/test/GameSource/Server/game/src/desc.cpp:332:30
    #13 0x00cb664b in io_loop(fdwatch*) /usr/test/GameSource/Server/game/src/main.cpp
    #14 0x00cb61ea in idle() /usr/test/GameSource/Server/game/src/main.cpp:929:7
    #15 0x00cb36d4 in main /usr/test/GameSource/Server/game/src/main.cpp:567:9
    #16 0x214bd494 in __libc_start1 /usr/src/lib/libc/csu/libc_start1.c:157:7
    #17 0x00733637 in _start /usr/src/lib/csu/i386/crt1_s.S:84
    #18 0xffbfed97  (<unknown module>)

SUMMARY: AddressSanitizer: heap-buffer-overflow /usr/test/GameSource/Server/game/src/item_manager.cpp:645:23 in ITEM_MANAGER::RealNumber(unsigned int)

 

Edited March 28 by Kuqsal