浏览代码

map-server: increased size of skilldb_id2idx[] array, to prevent out-of-bounds access.

Bug:
It was Initially declared as size of UINT16_MAX (0xffff) but as the skill-id itself which will be used
as offset can reach this value, it's too small.
Florian Wilkemeyer 9 年之前
父节点
当前提交
f7bc696335
共有 1 个文件被更改,包括 2 次插入2 次删除
  1. 2 2
      src/map/skill.c

+ 2 - 2
src/map/skill.c

@@ -58,7 +58,7 @@
 #endif
 
 DBMap* skilldb_name2id = NULL;
-static uint16 skilldb_id2idx[UINT16_MAX];/// Skill ID to Index lookup: skill_index = skill_get_index(skill_id) - [FWI] 20160423 the whole index thing should be removed.
+static uint16 skilldb_id2idx[(UINT16_MAX+1)];/// Skill ID to Index lookup: skill_index = skill_get_index(skill_id) - [FWI] 20160423 the whole index thing should be removed.
 struct s_skill_db **skill_db;			 /// Skill DB
 static uint16 skill_num;				 /// Skill count, also as last index
 #define skill_next_idx() ( skill_num++ ) /// Macro to get&increase last skill number/index
@@ -21227,7 +21227,7 @@ static void skill_readdb(void)
 	};
 	
 	db_clear(skilldb_name2id);
-	for(i = 0; i < UINT16_MAX; i++)
+	for(i = 0; i < (UINT16_MAX+1); i++)
 		skilldb_id2idx[i] = 0;
 
 	skill_db_destroy();