Skip to content
This repository has been archived by the owner on Apr 23, 2024. It is now read-only.

Commit

Permalink
Guard against other zero-size CUtlVector derefs
Browse files Browse the repository at this point in the history
  • Loading branch information
nosoop committed Jan 31, 2022
1 parent fb875d3 commit f38ddaf
Showing 1 changed file with 11 additions and 3 deletions.
14 changes: 11 additions & 3 deletions scripting/tf2attributes.sp
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@

#define PLUGIN_NAME "[TF2] TF2Attributes"
#define PLUGIN_AUTHOR "FlaminSarge"
#define PLUGIN_VERSION "[email protected]"
#define PLUGIN_VERSION "[email protected].1"
#define PLUGIN_CONTACT "http://forums.alliedmods.net/showthread.php?t=210221"
#define PLUGIN_DESCRIPTION "Functions to add/get attributes for TF2 players/items"

Expand Down Expand Up @@ -409,6 +409,10 @@ static int GetStaticAttribs(Address pItemDef, int[] iAttribIndices, int[] iAttri
// 0x1C = (...) m_Attributes.m_Memory.m_pMemory (m_Attributes + 0x00)
// 0x28 = (...) m_Attributes.m_Size (m_Attributes + 0x0C)
int iNumAttribs = LoadFromAddressOffset(pItemDef, 0x28, NumberType_Int32);
if (!iNumAttribs) {
return 0;
}

Address pAttribList = DereferencePointer(pItemDef, .offset = 0x1C);

// Read static_attrib_t (size 0x08) entries from contiguous block of memory
Expand Down Expand Up @@ -804,13 +808,17 @@ public int Native_ListIDs(Handle plugin, int numParams) {
return ThrowNativeError(SP_ERROR_NATIVE, "Entity %d (%d) does not have property m_AttributeList", EntIndexToEntRef(entity), entity);
}

// 0x10 = CAttributeList.m_Attributes.m_Size (m_Attributes + 0x0C)
int iNumAttribs = LoadFromAddressOffset(pAttributeList, 0x10, NumberType_Int32);
if (!iNumAttribs) {
return 0;
}

// 0x04 = CAttributeList.m_Attributes (type CUtlVector<CEconItemAttribute>)
// 0x04 = CAttributeList.m_Attributes.m_Memory.m_pMemory
Address pAttribListData = DereferencePointer(pAttributeList, .offset = 0x04);
AssertValidAddress(pAttribListData);

// 0x10 = CAttributeList.m_Attributes.m_Size (m_Attributes + 0x0C)
int iNumAttribs = LoadFromAddressOffset(pAttributeList, 0x10, NumberType_Int32);
int[] iAttribIndices = new int[size];

// Read CEconItemAttribute (size 0x10) entries from contiguous block of memory
Expand Down

0 comments on commit f38ddaf

Please sign in to comment.