fuzzball-muck / fuzzball

Ongoing development of the Fuzzball MUCK server software and associated functionality.
Other
47 stars 27 forks source link

Fix memory errors in prim_gui_value_set, GuiFree #554

Closed charlesreiss closed 4 years ago

charlesreiss commented 4 years ago

Via some fuzzing, I discovered that prim_gui_value_set tries to call free() on an uninitialized pointer when it is passed a dictionary-like array instead of a list-like array. This fixes that, triggering an abort_interp() in that case.

In the process of testing this, I also noticed that GuiFree() failed to free dialog control tracking structs fully.

This patch also adds a couple tests for gui_value_set. This includes some hard-coded MCP messages to make the mcpgui code believe that it's talking to a client that supports the MCP GUI stuff.