comparison GUIFont.cpp @ 200:1527f66fd81b

Buffer overflow in credits window
author Nomad
date Sat, 16 Feb 2013 22:35:58 +0200
parents 038a4d09406f
children c0bfb386b15f
comparison
equal deleted inserted replaced
199:66db86fa4ed2 200:1527f66fd81b
1 #include <string> 1 #include <string>
2 #include <assert.h>
3
2 #include "LOD.h" 4 #include "LOD.h"
3 #include "GUIFont.h" 5 #include "GUIFont.h"
4 #include "GUIWindow.h" 6 #include "GUIWindow.h"
5 #include "Render.h" 7 #include "Render.h"
6 8
21 struct GUIFont *pFontComic; 23 struct GUIFont *pFontComic;
22 struct GUIFont *pFontSmallnum; 24 struct GUIFont *pFontSmallnum;
23 25
24 char temp_string[2048]; 26 char temp_string[2048];
25 27
26 char pTmpBuf3[2048]; 28 char pTmpBuf3[10000];
27 29
28 //----- (0044C448) -------------------------------------------------------- 30 //----- (0044C448) --------------------------------------------------------
29 GUIFont *LoadFont(const char *pFontFile, const char *pFontPalette, ...) 31 GUIFont *LoadFont(const char *pFontFile, const char *pFontPalette, ...)
30 { 32 {
31 33
32 int pallete_index; // eax@3 34 int pallete_index; // eax@3
33 GUIFont *pFont; 35 GUIFont *pFont;
34 unsigned int palletes_count =0; 36 unsigned int palletes_count =0;
35 va_list palettes_ptr; 37 va_list palettes_ptr;
346 return 0; 348 return 0;
347 } 349 }
348 v8 = strlen(pString); 350 v8 = strlen(pString);
349 v9 = v8; 351 v9 = v8;
350 v39 = v8; 352 v39 = v8;
353
354 assert(strlen(v6) < sizeof(pTmpBuf3));
351 strcpy(pTmpBuf3, v6); 355 strcpy(pTmpBuf3, v6);
352 v10 = a5; 356 v10 = a5;
353 v11 = v35; 357 v11 = v35;
354 v12 = 0; 358 v12 = 0;
355 v40 = 0; 359 v40 = 0;