dethrace-labs / dethrace

Reverse engineering the 1997 game "Carmageddon"
https://twitter.com/dethrace_labs
GNU General Public License v3.0
859 stars 44 forks source link

Fix buffer under/overflows in `SmokeLine` (#132) #295

Closed zear closed 1 year ago

zear commented 1 year ago

When SmokeLine is called through DrawTheGlow, the calculated shade table offset might result in a negative value. Subject to usual arithmetic conversions, it is then treated as a large unsigned array index. On 32-bit systems (e.g. OG builds for DOS, Windows 95), the pointer arithmetic overflows and produces a negative index access, simply grabbing game data a few bytes before the start of the table. On 64-bit platforms this instead results in page fault.

  1. Keep table offset in a signed integer, making the negative values explicit. This provides OG behavior for 64-bit builds.
  2. Optionally, cap all negative values at 0, preventing underflows.

Fixes #132