mirrors
/
OpenRCT2
mirror of https://github.com/OpenRCT2/OpenRCT2.git
2
0
Fork 0
Code Issues Projects Releases Wiki Activity

Fix possible bad memory access when placing track design 

Name of ride can be set to a string of variable length, like in
`track_design_open` it gets set to the variable length filename. In
`ride_set_name`, however, the ride name is accessed as if it was
36-bytes long anyway. This makes sure all 36 bytes are available for
accessing.
This commit is contained in:
Michał Janiszewski 2016-05-06 10:58:06 +02:00 committed by Ted John
parent 227c772099
commit 0366a6c57f
1 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/ride/ride.c
View File

@ -5498,10 +5498,12 @@ void game_command_set_ride_status(int *eax, int *ebx, int *ecx, int *edx, int *e
void ride_set_name(int rideIndex, const char *name)
{
char name_buffer[36];
safe_strcpy(name_buffer, name, sizeof(name_buffer));
gGameCommandErrorTitle = STR_CANT_RENAME_RIDE_ATTRACTION;
game_do_command(1, (rideIndex << 8) | 1, 0, *((int*)(name + 0)), GAME_COMMAND_SET_RIDE_NAME, *((int*)(name + 8)), *((int*)(name + 4)));
game_do_command(2, (rideIndex << 8) | 1, 0, *((int*)(name + 12)), GAME_COMMAND_SET_RIDE_NAME, *((int*)(name + 20)), *((int*)(name + 16)));
game_do_command(0, (rideIndex << 8) | 1, 0, *((int*)(name + 24)), GAME_COMMAND_SET_RIDE_NAME, *((int*)(name + 32)), *((int*)(name + 28)));
game_do_command(1, (rideIndex << 8) | 1, 0, *((int*)(name_buffer + 0)), GAME_COMMAND_SET_RIDE_NAME, *((int*)(name_buffer + 8)), *((int*)(name_buffer + 4)));
game_do_command(2, (rideIndex << 8) | 1, 0, *((int*)(name_buffer + 12)), GAME_COMMAND_SET_RIDE_NAME, *((int*)(name_buffer + 20)), *((int*)(name_buffer + 16)));
game_do_command(0, (rideIndex << 8) | 1, 0, *((int*)(name_buffer + 24)), GAME_COMMAND_SET_RIDE_NAME, *((int*)(name_buffer + 32)), *((int*)(name_buffer + 28)));
}
/**