empire/empserver
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

navigate: Fix buffer overrun for impossibly long paths taken

Browse source 
When a player moves more than 1023 sectors in a single navigate
command, we overrun the buffer holding the path taken.  Remote hole,
but it requires a ship that can go that far, and even a ship with
speed 1000 would need a tech level well in excess of 1000 for that.
Thus, the hole is purely theoretical for even remotely sane game
configurations.

First known version with the flaw is 4.0.0.

Fix by going back the older behavior: don't print the total path
taken, but do print what the path finder does.  Context diff of an
example:

     [0:634] Command : nav 3 6,0
     Flagship is od   oil derrick (#3)
    +Using path 'n'
      h =
     k . .
      j d
     <67.2:67.2: 6,0> h
     od   oil derrick (#3) stopped at 6,0
    -Path taken: n

This is how march works.

Removes the only use of shp_nav_one_sector()'s unusual return value 2.
Return 1 instead.

Signed-off-by: Markus Armbruster <armbru@pond.sub.org>
This commit is contained in:
Markus Armbruster 2014-12-22 15:29:17 +01:00
parent 56ac486cc8
commit a4e519c377
7 changed files with 9 additions and 60 deletions
Download patch file Download diff file Expand all files Collapse all files

3
tests/retreat/journal.log
View file

@ -278,7 +278,6 @@
Play#1 command navigate
Play#1 output Play#1 1 Flagship is dd destroyer (#5)
Play#1 output Play#1 1 dd destroyer (#5) stopped at -5,-1
Play#1 output Play#1 1 Path taken: gyu
Play#1 output Play#1 6 0 610
Play#1 input fire sh 5 53
Play#1 command fire
@ -731,13 +730,11 @@
Play#1 output Play#1 1 . . . .
Play#1 output Play#1 1
Play#1 output Play#1 1 dd destroyer (#5) stopped at -6,0
Play#1 output Play#1 1 Path taken: b
Play#1 output Play#1 6 0 573
Play#1 input navi 5 nh
Play#1 command navigate
Play#1 output Play#1 1 Flagship is dd destroyer (#5)
Play#1 output Play#1 1 dd destroyer (#5) stopped at -5,1
Play#1 output Play#1 1 Path taken: n
Play#1 output Play#1 6 0 572
Play#1 input board 130 5
Play#1 command board