[Freeciv-Dev] (PR#9439) Patch: writing over array bounds in make_river()

["res" <resqu@xxxxxx>]

<URL: http://rt.freeciv.org/Ticket/Display.html?id=9439 >

The rd_comparison_val and rd_direction_is_valid variables in 
make_river() were all arrays of size 4. However, the indices used to 
access those arrays are all in the range of direction8, ie values up to 
7. Fixed by enlarging those arrays and adding a bit of code to properly 
initialize rd_direction_is_valid.


Index: common/map.h
===================================================================
RCS file: /home/freeciv/CVS/freeciv/common/map.h,v
retrieving revision 1.197
diff -u -r1.197 map.h
--- common/map.h        19 Jul 2004 17:13:38 -0000      1.197
+++ common/map.h        20 Jul 2004 11:44:36 -0000
@@ -139,7 +139,9 @@
   DIR8_EAST = 4,
   DIR8_SOUTHWEST = 5,
   DIR8_SOUTH = 6,
-  DIR8_SOUTHEAST = 7
+  DIR8_SOUTHEAST = 7,
+
+  DIR8_COUNT = 8
 };
 
 struct civ_map {

Index: server/mapgen.c
===================================================================
RCS file: /home/freeciv/CVS/freeciv/server/mapgen.c,v
retrieving revision 1.139
diff -u -r1.139 mapgen.c
--- server/mapgen.c     9 Jul 2004 19:30:58 -0000       1.139
+++ server/mapgen.c     20 Jul 2004 12:12:55 -0000
@@ -796,9 +796,9 @@
   /* The comparison values of the 4 tiles surrounding the current
      tile. It is the suitability to continue a river to that tile that
      is being compared. Lower is better.                  -Erik Sigra */
-  static int rd_comparison_val[4];
+  static int rd_comparison_val[DIR8_COUNT];
 
-  bool rd_direction_is_valid[4];
+  bool rd_direction_is_valid[DIR8_COUNT];
   int num_valid_directions, dir, func_num, direction;
 
   while (TRUE) {
@@ -824,9 +824,11 @@
     freelog(LOG_DEBUG,
            "The river did not end at (%d, %d). Evaluating directions...\n", x, 
y);
 
-    /* Mark all directions as available. */
-    for (dir = 0; dir < 4; dir++)
-      rd_direction_is_valid[dir] = TRUE;
+    /* Mark all cardinal directions as available. */
+    for (dir = 0; dir < DIR8_COUNT; dir++)
+      rd_direction_is_valid[dir] = FALSE;
+    for (dir = 0; dir < map.num_cardinal_dirs; dir++)
+      rd_direction_is_valid[map.cardinal_dirs[dir]] = TRUE;
 
     /* Test series that selects a direction for the river. */
     for (func_num = 0; func_num < NUM_TEST_FUNCTIONS; func_num++) {
@@ -859,7 +861,7 @@
     /* Directions evaluated with all functions. Now choose the best
        direction before going to the next iteration of the while loop */
     num_valid_directions = 0;
-    for (dir = 0; dir < 4; dir++)
+    for (dir = 0; dir < DIR8_COUNT; dir++)
       if (rd_direction_is_valid[dir])
        num_valid_directions++;