cargo_iter_next() uses -1 array index

• 回報者: cazfi
• 負責人: cazfi
• 類型: 問題回報
• 狀態: 關閉
• 元件: General
• 里程碑: 3.0.8 (closed)
• 優先權: 5 - 中
• 嚴重程度: 5 - 中
• 處理結果: 修正
• 檔案: 2

細節

Reported by alain_bkr in https://osdn.net/projects/freeciv/ticket/47748#comment:12505:47748:1681095349 :

> ../../common/unit.c:2475:13: runtime error: index -1 out of bounds for type 'const struct unit_list_link *[5]'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ../../common/unit.c:2475:13 in

This was with S3_1.

Ticket History (3/8 Histories)

2023-04-22 19:29 Updated by: cazfi

• New Ticket "cargo_iter_next() uses -1 array index" created

2023-04-22 19:42 Updated by: cazfi

• File 0024-Fix-cargo_iter_next-out-of-bounds-read.patch (File ID: 12246) is attached

2023-04-22 19:43 Updated by: cazfi

• File 0046-Fix-cargo_iter_next-out-of-bounds-read.patch (File ID: 12247) is attached

2023-04-22 19:45 Updated by: cazfi

• 負責人 Update from (無) to cazfi
• 處理結果 Update from 無 to Accepted
• 里程碑 Update from (無) to 3.0.8 (closed)

評語

The difference between attached patches is that main / S3_2 one adds an assert that more stable branches patch does not.

2023-04-23 02:57 Updated by: cazfi

評語

S3_1/S3_0 patch also for S2_6.

2023-04-23 03:52 Updated by: cazfi

評語

Likely duplicate -> #47661

2023-04-26 11:52 Updated by: cazfi

• 狀態 Update from 開啟 to 關閉
• 處理結果 Update from Accepted to 修正

2023-05-05 21:44 Updated by: alain_bkr

評語

this does not fix the problem

#47982 has the complete fix

(Edited, 2023-05-05 21:46 Updated by: alain_bkr)