[Freeciv-Dev] Re: (PR#9439) Patch: writing over array bounds in make_river()

["res" <resqu@xxxxxx>]

<URL: http://rt.freeciv.org/Ticket/Display.html?id=9439 >

On 20.07.2004 17:51, Jason Short wrote:

> <URL: http://rt.freeciv.org/Ticket/Display.html?id=9439 >
> 
>>[resqu@xxxxxx - Tue Jul 20 14:32:15 2004]:
>>
>>The rd_comparison_val and rd_direction_is_valid variables in 
>>make_river() were all arrays of size 4. However, the indices used to 
>>access those arrays are all in the range of direction8, ie values up to 
>>7. Fixed by enlarging those arrays and adding a bit of code to properly 
>>initialize rd_direction_is_valid.
> 
> 
> Bug, bug, bug...
> 
> Obviously it's a bug that the array is too small.  This is my fault.
> 
> But your patch is also buggy, I think.  

Possibly. I focused on replacing the too-small array with a larger one 
and didn't try too much to get into its high-level semantics.

> This is a modification of your patch that fixes all the above.  I
> removed the DIR8_COUNT enumeration value.  It can't be added to the enum
> without giving all sorts of "DIR8_COUNT not handled in switch" warnings.

Ah, true, didn't think of that.

Thanks for looking at (and subsequently fixing) the fix.
-f.r.