cargo_iter_next() uses -1 array index

• Rapporteur: cazfi
• Propriétaire: cazfi
• Type: Bogues
• État: Atteints
• Composant: General
• Jalon: 3.0.8 (atteints)
• Priorité: 5 - moyen
• Sévérité: 5 - moyen
• Résolution: Fixed
• Fichier: 2

Détails

Reported by alain_bkr in https://osdn.net/projects/freeciv/ticket/47748#comment:12505:47748:1681095349 :

> ../../common/unit.c:2475:13: runtime error: index -1 out of bounds for type 'const struct unit_list_link *[5]'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ../../common/unit.c:2475:13 in

This was with S3_1.

Ticket History (3/8 Histories)

2023-04-22 19:29 Updated by: cazfi

• New Ticket "cargo_iter_next() uses -1 array index" created

2023-04-22 19:42 Updated by: cazfi

• File 0024-Fix-cargo_iter_next-out-of-bounds-read.patch (File ID: 12246) is attached

2023-04-22 19:43 Updated by: cazfi

• File 0046-Fix-cargo_iter_next-out-of-bounds-read.patch (File ID: 12247) is attached

2023-04-22 19:45 Updated by: cazfi

• Propriétaire Update from (Aucun) to cazfi
• Résolution Update from Aucun to Accepted
• Jalon Update from (Aucun) to 3.0.8 (atteints)

Commentaire

The difference between attached patches is that main / S3_2 one adds an assert that more stable branches patch does not.

2023-04-23 02:57 Updated by: cazfi

Commentaire

S3_1/S3_0 patch also for S2_6.

2023-04-23 03:52 Updated by: cazfi

Commentaire

Likely duplicate -> #47661

2023-04-26 11:52 Updated by: cazfi

• État Update from Ouvert to Atteints
• Résolution Update from Accepted to Fixed

2023-05-05 21:44 Updated by: alain_bkr

Commentaire

this does not fix the problem

#47982 has the complete fix

(Edited, 2023-05-05 21:46 Updated by: alain_bkr)