QW-Group / mvdsv

MVDSV: a QuakeWorld server
GNU General Public License v2.0
59 stars 56 forks source link

Possible integer overflow in integer value sent to mod as seed value #140

Closed ciscon closed 2 months ago

ciscon commented 4 months ago

in pr2_exec.c we cast sys_doubletime*100000 to an integer and send this to the mod, which uses it as a seed for random values, after a few hours of uptime this value can overflow.

src/pr2_exec.c: gamedata_ptr = (intptr_t) VM_Call(sv_vm, 2, GAME_INIT, (int)(sv.time * 1000), (int)(Sys_DoubleTime() * 100000), 0, 0, 0, 0, 0, 0, 0, 0, 0, 0);

suggest we just use (int)Sys_DoubleTime() as this value just needs to be unique each time this is called (at game start), or just use epoch to make sure it's "always" a different value.

-reported by phylter and zorak

VVD commented 4 months ago

after a few hours of uptime this value can overflow.

clang generate always -2147483648 if overflow. We can use (int)( (unsigned int) (Sys_DoubleTime() * 100000) ). Testing:

#include <stdio.h>
double Sys_DoubleTime(double d) {
  return d;
}
int main() {
  printf("double = %lf\n", Sys_DoubleTime(40000.) * 100000);
  printf("u = %d\n", (int) (unsigned int) (Sys_DoubleTime(40000.) * 100000) );
  printf("d = %d\n", (int) (Sys_DoubleTime(40000.) * 100000) );
  int i = Sys_DoubleTime(40000.) * 100000;
  printf("i = %d\n", i);
  return 0;
}
double = 4000000000.000000
u = -294967296
d = -2147483648
i = -2147483648