Zeex / sampgdk

Write SA-MP gamemodes in C/C++
http://zeex.github.io/sampgdk
Apache License 2.0
156 stars 83 forks source link

OOB access in `_sampgdk_amxhooks_Register` #188

Closed Y-Less closed 7 years ago

Y-Less commented 7 years ago
  for (i = 0; nativelist[i].name != 0 && (i < number || number == -1); i++) {
    sampgdk_log_debug("Registering native: %s @ %p", nativelist[i].name,
                                                     nativelist[i].func);
    sampgdk_native_register(nativelist[i].name, nativelist[i].func);
  }

I was calling the function with a single native, and number set to 1, but the nativelist[i].name != 0 check is done before the i < number range check. It should be this when not using a sentinel value:

  for (i = 0; (i < number || number == -1) && nativelist[i].name != 0; i++) {
    sampgdk_log_debug("Registering native: %s @ %p", nativelist[i].name,
                                                     nativelist[i].func);
    sampgdk_native_register(nativelist[i].name, nativelist[i].func);
  }

However, I just checked and the same overflow is in findfunction in the original AMX code.

Edit: Not an overflow, since nothing is written, but still OOB.