Thread: Bad memory read
View Single Post
Old August 13, 2010, 22:10   #1
Join Date: Jul 2010
Posts: 9
jbu is on a distinguished road
Bad memory read

fwiw I just found a bad memory read in spells2.c

void map_area(void)
	int i, x, y;
	int x1, x2, y1, y2;

	/* Pick an area to map */
	y1 = p_ptr->py - DETECT_DIST_Y;
	y2 = p_ptr->py + DETECT_DIST_Y;
	x1 = p_ptr->px - DETECT_DIST_X;
	x2 = p_ptr->px + DETECT_DIST_X;

	if (y1 < 0) y1 = 0;
	if (x1 < 0) x1 = 0;

	/* Scan the dungeon */
	for (y = y1; y < y2; y++)
		for (x = x1; x < x2; x++)
			/* All non-walls are "checked" */
			if (cave_feat[y][x] < FEAT_SECRET)
				if (!in_bounds_fully(y, x)) continue;
Now, there is no check on the outer bounds for x2 and y2 and they might (will) exceed the borders of cave_feat. The in_bounds_fully() check is done after the read. A fix is to move that check to the start of the loop or just restrict the loop upper bounds.

jbu is offline   Reply With Quote