asgardius/virtualx-engine
1
0
Fork 0
Code Issues Pull requests Projects Releases 1 Packages Wiki Activity Actions

[Marshalls] Fix Float64Array and Int64Array serialization.

Browse source 
One was incorrectly reading the size (potentially causing out-of-buffer
read), the other also potentially causing out-of-buffer write during
encoding.
This commit is contained in:
Fabio Alessandrelli 2021-08-02 13:34:06 +02:00
parent 33fd41472c
commit fed0bf013a
1 changed files with 3 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
core/io/marshalls.cpp
View file

@ -746,7 +746,7 @@ Error decode_variant(Variant &r_variant, const uint8_t *p_buffer, int p_len, int
} break; } break;
case Variant::PACKED_INT64_ARRAY: { case Variant::PACKED_INT64_ARRAY: {
ERR_FAIL_COND_V(len < 4, ERR_INVALID_DATA); ERR_FAIL_COND_V(len < 4, ERR_INVALID_DATA);
int64_t count = decode_uint64(buf); int32_t count = decode_uint32(buf);
buf += 4; buf += 4;
len -= 4; len -= 4;
ERR_FAIL_MUL_OF(count, 8, ERR_INVALID_DATA); ERR_FAIL_MUL_OF(count, 8, ERR_INVALID_DATA);
@ -795,7 +795,7 @@ Error decode_variant(Variant &r_variant, const uint8_t *p_buffer, int p_len, int
} break; } break;
case Variant::PACKED_FLOAT64_ARRAY: { case Variant::PACKED_FLOAT64_ARRAY: {
ERR_FAIL_COND_V(len < 4, ERR_INVALID_DATA); ERR_FAIL_COND_V(len < 4, ERR_INVALID_DATA);
int64_t count = decode_uint64(buf); int32_t count = decode_uint32(buf);
buf += 4; buf += 4;
len -= 4; len -= 4;
ERR_FAIL_MUL_OF(count, 8, ERR_INVALID_DATA); ERR_FAIL_MUL_OF(count, 8, ERR_INVALID_DATA);
@ -804,7 +804,6 @@ Error decode_variant(Variant &r_variant, const uint8_t *p_buffer, int p_len, int
Vector<double> data; Vector<double> data;
if (count) { if (count) {
//const double*rbuf=(const double*)buf;
data.resize(count); data.resize(count);
double *w = data.ptrw(); double *w = data.ptrw();
for (int64_t i = 0; i < count; i++) { for (int64_t i = 0; i < count; i++) {
@ -1519,7 +1518,7 @@ Error encode_variant(const Variant &p_variant, uint8_t *r_buffer, int &r_len, bo
int datasize = sizeof(int64_t); int datasize = sizeof(int64_t);
if (buf) { if (buf) {
encode_uint64(datalen, buf); encode_uint32(datalen, buf);
buf += 4; buf += 4;
const int64_t *r = data.ptr(); const int64_t *r = data.ptr();
for (int64_t i = 0; i < datalen; i++) { for (int64_t i = 0; i < datalen; i++) {