UNLOZE/sourcemod
10
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

fixed a trie (corruption/invalid memory access) bug found while investigating amb779

Browse Source 
--HG--
extra : convert_revision : svn%3A39bc706e-5318-0410-9160-8a85361fbb7c/trunk%401368
This commit is contained in:
David Anderson 2007-08-21 16:20:28 +00:00
parent 25f045bdea
commit 89899de7b0
1 changed files with 12 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
core/sm_trie.cpp
View File

@ -558,7 +558,12 @@ bool sm_trie_add(Trie *trie, const char *key, void *value, bool replace_allowed)
if (base[newidx].mode == Node_Arc) if (base[newidx].mode == Node_Arc)
{ {
TrieNode *check_base = &base[base[newidx].idx] + 1; TrieNode *check_base = &base[base[newidx].idx] + 1;
for (unsigned int j=1; j<=255; j++, check_base++) outgoing_limit = (base + trie->baseSize + 1) - check_base;
if (outgoing_limit > 255)
{
outgoing_limit = 255;
}
for (unsigned int j=1; j<=outgoing_limit; j++, check_base++)
{ {
if (check_base->parent == oldidx) if (check_base->parent == oldidx)
{ {
@ -602,7 +607,12 @@ bool sm_trie_add(Trie *trie, const char *key, void *value, bool replace_allowed)
if (base[newidx].mode == Node_Arc) if (base[newidx].mode == Node_Arc)
{ {
TrieNode *check_base = &base[base[newidx].idx] + 1; TrieNode *check_base = &base[base[newidx].idx] + 1;
for (unsigned int j=1; j<=255; j++, check_base++) outgoing_limit = (base + trie->baseSize + 1) - check_base;
if (outgoing_limit > 255)
{
outgoing_limit = 255;
}
for (unsigned int j=1; j<=outgoing_limit; j++, check_base++)
{ {
if (check_base->parent == oldidx) if (check_base->parent == oldidx)
{ {