luisTJ / ghostplusplus

Automatically exported from code.google.com/p/ghostplusplus
Other
0 stars 0 forks source link

ghostplusplus crash (stack corruption) under x86-64 PPC platform. #136

Open GoogleCodeExporter opened 9 years ago

GoogleCodeExporter commented 9 years ago
What steps will reproduce the problem?
1. build ghost++
2. setup ghost++
3. run ghost++

What is the expected output? What do you see instead?
-

What version of the product are you using? On what operating system?
the latest revision from trunk on 01-03-2013

Watch CBNCSUtilInterface :: HELP_SID_AUTH_CHECK function in 
bncsutilinterface.cpp:

uint32_t EXEVersionHash;
checkRevisionFlat( ..., (unsigned long*)&EXEVersionHash );

We CAN NOT pass a pointer to the 32-bit value as a 64-bit value pointer. Even 
if we know that value is less than 0xFFFFFFFF
This will cause a stack corruption under x86-64 little-endian platform. 

Why it works under x86-64 big endian: 
    Low 32 bits under BE are stored in in the first 4 bytes of 8-byte unsigned long value.

But under LE it causes a stack corruption because a local variable 
EXEVersionHash (it is stored on the stack) is only 4-byte size, so 
checkRevisionFlat tries to put the result in (&EXEVersionHash + 4).

How to fix:

unsigned long EXEVersionHash;
checkRevisionFlat( valueStringFormula.c_str( ), FileWar3EXE.c_str( ), 
FileStormDLL.c_str( ), FileGameDLL.c_str( ), extractMPQNumber( 
mpqFileName.c_str( ) ), &EXEVersionHash );

// A compiler will automatically cast 64-bit value to the 32-bit one 
considering LE/BE byte order.
uint32_t EXEVersionHash32 = (uint32_t)EXEVersionHash;
m_EXEVersionHash = UTIL_CreateByteArray( EXEVersionHash32, false );

Original issue reported on code.google.com by FukOfHea...@gmail.com on 1 Mar 2013 at 1:16

GoogleCodeExporter commented 9 years ago
Hi, thanks for reporting this, should be fixed in the SVN shortly.

Original comment by Perenn...@gmail.com on 28 May 2013 at 2:00

GoogleCodeExporter commented 9 years ago
Thanks for explaining this. Works

Original comment by masterpe...@gmail.com on 28 Nov 2013 at 5:50

GoogleCodeExporter commented 9 years ago
Can owners link issues 130, 134, 136? 136 fixes them all

Original comment by masterpe...@gmail.com on 28 Nov 2013 at 5:52