cargo_iter_next() uses -1 array index

• 报告人: cazfi
• 属主: cazfi
• 类型: Bugs
• 状态: 关闭
• 组件: General
• 里程碑: 3.0.8 (关闭)
• 优先: 5 - Medium
• 严重性: 5 - Medium
• 处理结果: Fixed
• 文件: 2

Details

Reported by alain_bkr in https://osdn.net/projects/freeciv/ticket/47748#comment:12505:47748:1681095349 :

> ../../common/unit.c:2475:13: runtime error: index -1 out of bounds for type 'const struct unit_list_link *[5]'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ../../common/unit.c:2475:13 in

This was with S3_1.

任务单历史 (3/8 Histories)

2023-04-22 19:29 Updated by: cazfi

• New Ticket "cargo_iter_next() uses -1 array index" created

2023-04-22 19:42 Updated by: cazfi

• File 0024-Fix-cargo_iter_next-out-of-bounds-read.patch (File ID: 12246) is attached

2023-04-22 19:43 Updated by: cazfi

• File 0046-Fix-cargo_iter_next-out-of-bounds-read.patch (File ID: 12247) is attached

2023-04-22 19:45 Updated by: cazfi

• 属主 Update from (无) to cazfi
• 处理结果 Update from 无 to Accepted
• 里程碑 Update from (无) to 3.0.8 (关闭)

评论

The difference between attached patches is that main / S3_2 one adds an assert that more stable branches patch does not.

2023-04-23 02:57 Updated by: cazfi

评论

S3_1/S3_0 patch also for S2_6.

2023-04-23 03:52 Updated by: cazfi

评论

Likely duplicate -> #47661

2023-04-26 11:52 Updated by: cazfi

• 状态 Update from 开启 to 关闭
• 处理结果 Update from Accepted to Fixed

2023-05-05 21:44 Updated by: alain_bkr

评论

this does not fix the problem

#47982 has the complete fix

(Edited, 2023-05-05 21:46 Updated by: alain_bkr)