empire/empserver
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

retreat: Fix stack smash in land unit group retreat

Browse source 
retreat_land() reads ships instead of land units, overrunning local
variable land.  On lucky systems such as mine, this clobbers ni, and
triggers an oops.  On unlucky systems, it crashes.  On really unlucky
systems, it corrupts the land units file.

Broken since land unit retreat was added in Chainsaw 3.

Signed-off-by: Markus Armbruster <armbru@pond.sub.org>
This commit is contained in:
Markus Armbruster 2014-01-20 20:28:17 +01:00
parent a963b4e703
commit 2cc0664e3e
5 changed files with 30 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

2
src/lib/subs/retreat.c
View file

@ -355,7 +355,7 @@ retreat_land(struct lndstr *lp, char code)
struct lndstr land;
if (lp->lnd_rflags & RET_GROUP) {
snxtitem_group(&ni, EF_SHIP, lp->lnd_army);
snxtitem_group(&ni, EF_LAND, lp->lnd_army);
while (nxtitem(&ni, &land))
if (land.lnd_own == lp->lnd_own) {
if (land.lnd_uid == lp->lnd_uid) {