From: <tu...@us...> - 2012-02-18 12:39:20
|
Revision: 514 http://polserver.svn.sourceforge.net/polserver/?rev=514&view=rev Author: turley Date: 2012-02-18 12:39:13 +0000 (Sat, 18 Feb 2012) Log Message: ----------- fixed possible crash with tooltip pkt Modified Paths: -------------- trunk/pol-core/pol/network/packets.h trunk/pol-core/pol/tooltips.cpp Modified: trunk/pol-core/pol/network/packets.h =================================================================== --- trunk/pol-core/pol/network/packets.h 2012-02-18 12:20:15 UTC (rev 513) +++ trunk/pol-core/pol/network/packets.h 2012-02-18 12:39:13 UTC (rev 514) @@ -444,7 +444,7 @@ typedef PacketTemplate<PKTBI_C2_ID,21> PktOut_C2; typedef PacketTemplate<PKTOUT_C7_ID,49> PktOut_C7; typedef PacketTemplate<PKTOUT_CC_ID,49+(SPEECH_MAX_LEN+1)*2+SPEECH_MAX_LEN+1> PktOut_CC; -typedef PacketTemplate<PKTBI_D6_OUT_ID,25+(4*SPEECH_MAX_LEN)> PktOut_D6; +typedef PacketTemplate<PKTBI_D6_OUT_ID,0xFFFF> PktOut_D6; typedef PacketTemplate<PKTOUT_DC_ID,9> PktOut_DC; typedef PacketTemplate<PKTOUT_DD_ID,0xFFFF> PktOut_DD; typedef PacketTemplate<PKTOUT_E3_ID,77> PktOut_E3; Modified: trunk/pol-core/pol/tooltips.cpp =================================================================== --- trunk/pol-core/pol/tooltips.cpp 2012-02-18 12:20:15 UTC (rev 513) +++ trunk/pol-core/pol/tooltips.cpp 2012-02-18 12:39:13 UTC (rev 514) @@ -167,9 +167,15 @@ else msg->WriteFlipped(static_cast<u32>(1042971)); //1 text argument only - msg->WriteFlipped(static_cast<u16>(desc.size()*2)); + u16 textlen=desc.size(); + if ((textlen*2)>(0xFFFF - 22)) + { + textlen=0xFFFF/2 - 22; + } + msg->WriteFlipped(textlen*2); const char* string = desc.c_str(); - while (*string) //unicode + + while (*string && textlen--) //unicode msg->Write(static_cast<u16>(*string++)); msg->offset+=4; // indicates end of property list u16 len=msg->offset; This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |