3480: Fix client crash with too many items (fixes #3479) r=heinrich5991 a=def-

<!-- What is the motivation for the changes of this pull request -->

## Checklist

- [ ] Tested the change ingame
- [ ] Provided screenshots if it is a visual change
- [ ] Tested in combination with possibly related configuration options
- [ ] Written a unit test if it works standalone, system.c especially
- [ ] Considered possible null pointers and out of bounds array indexing
- [ ] Changed no physics that affect existing maps
- [ ] Tested the change with [ASan+UBSan or valgrind's memcheck](https://github.com/ddnet/ddnet/#using-addresssanitizer--undefinedbehavioursanitizer-or-valgrinds-memcheck) (optional)


Co-authored-by: def <dennis@felsin9.de>
This commit is contained in:
bors[bot] 2021-01-06 19:47:33 +00:00 committed by GitHub
commit d65ae499a4
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23

View file

@ -358,10 +358,12 @@ int CSnapshotDelta::UnpackDelta(CSnapshot *pFrom, CSnapshot *pTo, void *pSrcData
if(Keep)
{
void *pObj = Builder.NewItem(pFromItem->Type(), pFromItem->ID(), ItemSize);
if(!pObj)
return -4;
// keep it
mem_copy(
Builder.NewItem(pFromItem->Type(), pFromItem->ID(), ItemSize),
pFromItem->Data(), ItemSize);
mem_copy(pObj, pFromItem->Data(), ItemSize);
}
}
@ -397,7 +399,8 @@ int CSnapshotDelta::UnpackDelta(CSnapshot *pFrom, CSnapshot *pTo, void *pSrcData
if(!pNewData)
pNewData = (int *)Builder.NewItem(Key >> 16, Key & 0xffff, ItemSize);
//if(range_check(pEnd, pNewData, ItemSize)) return -4;
if(!pNewData)
return -4;
FromIndex = pFrom->GetItemIndex(Key);
if(FromIndex != -1)
@ -588,13 +591,16 @@ void CSnapshotBuilder::AddExtendedItemType(int Index)
int TypeID = m_aExtendedItemTypes[Index];
CUuid Uuid = g_UuidManager.GetUuid(TypeID);
int *pUuidItem = (int *)NewItem(0, GetTypeFromIndex(Index), sizeof(Uuid)); // NETOBJTYPE_EX
for(int i = 0; i < (int)sizeof(CUuid) / 4; i++)
if(pUuidItem)
{
pUuidItem[i] =
(Uuid.m_aData[i * 4 + 0] << 24) |
(Uuid.m_aData[i * 4 + 1] << 16) |
(Uuid.m_aData[i * 4 + 2] << 8) |
(Uuid.m_aData[i * 4 + 3]);
for(int i = 0; i < (int)sizeof(CUuid) / 4; i++)
{
pUuidItem[i] =
(Uuid.m_aData[i * 4 + 0] << 24) |
(Uuid.m_aData[i * 4 + 1] << 16) |
(Uuid.m_aData[i * 4 + 2] << 8) |
(Uuid.m_aData[i * 4 + 3]);
}
}
}