From a3c4d675ba19df385be5d1e3966c61de7186da57 Mon Sep 17 00:00:00 2001 From: shennetsind Date: Sat, 17 Jan 2015 20:18:49 -0200 Subject: 27 Fixes Addressing out of bounds read/write, pointless null checks on already deferenced variables. Special Thanks to 4144 and Haruna! Signed-off-by: shennetsind --- src/map/script.c | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) (limited to 'src/map/script.c') diff --git a/src/map/script.c b/src/map/script.c index 2249d53cc..549d3c269 100644 --- a/src/map/script.c +++ b/src/map/script.c @@ -14460,7 +14460,7 @@ BUILDIN(sprintf) { } if(arg>=argc) { ShowError("buildin_sprintf: Not enough arguments passed!\n"); - if(buf) aFree(buf); + aFree(buf); if(buf2) aFree(buf2); StrBuf->Destroy(&final_buf); script_pushconststr(st,""); @@ -14496,7 +14496,7 @@ BUILDIN(sprintf) { } } else { // Unsupported type ShowError("buildin_sprintf: Unknown argument type!\n"); - if(buf) aFree(buf); + aFree(buf); if(buf2) aFree(buf2); StrBuf->Destroy(&final_buf); script_pushconststr(st,""); @@ -14518,7 +14518,7 @@ BUILDIN(sprintf) { script_pushstrcopy(st, StrBuf->Value(&final_buf)); - if(buf) aFree(buf); + aFree(buf); if(buf2) aFree(buf2); StrBuf->Destroy(&final_buf); @@ -14577,7 +14577,7 @@ BUILDIN(sscanf) { if(arg>=argc) { ShowError("buildin_sscanf: Not enough arguments passed!\n"); script_pushint(st, -1); - if(buf) aFree(buf); + aFree(buf); if(ref_str) aFree(ref_str); return false; } @@ -14629,7 +14629,7 @@ BUILDIN(sscanf) { } script_pushint(st, arg); - if(buf) aFree(buf); + aFree(buf); if(ref_str) aFree(ref_str); return true; @@ -18055,7 +18055,10 @@ BUILDIN(npcskill) { skill_level = script_getnum(st, 3); stat_point = script_getnum(st, 4); npc_level = script_getnum(st, 5); - sd = script->rid2sd(st); + + if( !(sd = script->rid2sd(st)) ) + return false; + nd = (struct npc_data *)map->id2bl(sd->npc_id); if (stat_point > battle_config.max_third_parameter) { @@ -18066,7 +18069,7 @@ BUILDIN(npcskill) { ShowError("npcskill: level exceeded maximum of %d.\n", MAX_LEVEL); return false; } - if (sd == NULL || nd == NULL) { + if (nd == NULL) { return false; } @@ -18977,7 +18980,8 @@ BUILDIN(tradertype) { } #endif - nd->u.scr.shop->type = type; + if( nd->u.scr.shop ) + nd->u.scr.shop->type = type; return true; } -- cgit v1.2.3-70-g09d2