cargo_iter_next() uses -1 array index

• Informador: cazfi
• Propietario: cazfi
• Tipo: Bugs
• Estado: Cerrado
• Componente: General
• Hito: 3.0.8 (cerrado)
• Prioridad: 5 - Medium
• Gravedad: 5 - Medium
• Resolución: Fixed
• Fichero: 2

Details

Reported by alain_bkr in https://osdn.net/projects/freeciv/ticket/47748#comment:12505:47748:1681095349 :

> ../../common/unit.c:2475:13: runtime error: index -1 out of bounds for type 'const struct unit_list_link *[5]'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ../../common/unit.c:2475:13 in

This was with S3_1.

Ticket History (3/8 Histories)

2023-04-22 19:29 Updated by: cazfi

• New Ticket "cargo_iter_next() uses -1 array index" created

2023-04-22 19:42 Updated by: cazfi

• File 0024-Fix-cargo_iter_next-out-of-bounds-read.patch (File ID: 12246) is attached

2023-04-22 19:43 Updated by: cazfi

• File 0046-Fix-cargo_iter_next-out-of-bounds-read.patch (File ID: 12247) is attached

2023-04-22 19:45 Updated by: cazfi

• Propietario Update from (Ninguno) to cazfi
• Resolución Update from Ninguno to Accepted
• Hito Update from (Ninguno) to 3.0.8 (cerrado)

Comentario

The difference between attached patches is that main / S3_2 one adds an assert that more stable branches patch does not.

2023-04-23 02:57 Updated by: cazfi

Comentario

S3_1/S3_0 patch also for S2_6.

2023-04-23 03:52 Updated by: cazfi

Comentario

Likely duplicate -> #47661

2023-04-26 11:52 Updated by: cazfi

• Estado Update from Open to Cerrado
• Resolución Update from Accepted to Fixed

2023-05-05 21:44 Updated by: alain_bkr

Comentario

this does not fix the problem

#47982 has the complete fix

(Edited, 2023-05-05 21:46 Updated by: alain_bkr)