diff options
| author | Paradox924X <Paradox924X@54d463be-8e91-2dee-dedb-b68131a5f0ec> | 2008-10-24 21:18:15 +0000 |
|---|---|---|
| committer | Paradox924X <Paradox924X@54d463be-8e91-2dee-dedb-b68131a5f0ec> | 2008-10-24 21:18:15 +0000 |
| commit | 7c8415b104a7350f0ae76f73dcbd47c8f8f11224 (patch) | |
| tree | 8fa77959af3903a19165cd7714ec5d64c5569e4e /src | |
| parent | 7dac36b1e8a4d645f8d08b9a52e7e7fdc22d5d12 (diff) | |
| download | hercules-7c8415b104a7350f0ae76f73dcbd47c8f8f11224.tar.gz hercules-7c8415b104a7350f0ae76f73dcbd47c8f8f11224.tar.bz2 hercules-7c8415b104a7350f0ae76f73dcbd47c8f8f11224.tar.xz hercules-7c8415b104a7350f0ae76f73dcbd47c8f8f11224.zip | |
Added protection from segfault by int overflow in atcommand heal. (bugreport:1886)
git-svn-id: https://rathena.svn.sourceforge.net/svnroot/rathena/trunk@13321 54d463be-8e91-2dee-dedb-b68131a5f0ec
Diffstat (limited to 'src')
| -rw-r--r-- | src/map/atcommand.c | 12 |
1 files changed, 10 insertions, 2 deletions
diff --git a/src/map/atcommand.c b/src/map/atcommand.c index f29c13b39..b19481e39 100644 --- a/src/map/atcommand.c +++ b/src/map/atcommand.c @@ -1504,14 +1504,22 @@ int atcommand_heal(const int fd, struct map_session_data* sd, const char* comman sscanf(message, "%d %d", &hp, &sp); - if (hp == 0 && sp == 0) { + if ( ( hp == 0 && sp == 0 ) + || ( hp > 2147483647 || sp > 2147483647 ) ) { // Prevent overflow. [Paradox924X] if (!status_percent_heal(&sd->bl, 100, 100)) clif_displaymessage(fd, msg_txt(157)); // HP and SP have already been recovered. else clif_displaymessage(fd, msg_txt(17)); // HP, SP recovered. return 0; } - + + if ( hp < -2147483647 || sp < -2147483647 ) { // Prevent overflow. [Paradox924X] + status_damage(NULL, &sd->bl, 2147483647, 2147483647, 0, 0); + clif_damage(&sd->bl,&sd->bl, gettick(), 0, 0, -hp, 0 , 4, 0); + clif_displaymessage(fd, msg_txt(156)); // HP or/and SP modified. + return 0; + } + if(hp > 0 && sp >= 0) { if(!status_heal(&sd->bl, hp, sp, 0)) clif_displaymessage(fd, msg_txt(157)); // HP and SP are already with the good value. |