Skip to content
This repository was archived by the owner on Aug 31, 2021. It is now read-only.

Commit f804ae0

Browse files
runrevmarkrunrevmark
committed
[[ Bug 15034 ]] Fix non-64-bit clean uses of MCS_closetakingbuffer.
Incorrect reinterpret casts were being applied to the buffer length variable. This has been resolved by adding an MCS_closetakingbuffer_uint32 variant, which wraps MCS_closetakingbuffer and size checks the buffer size before returning.
1 parent cbf7987 commit f804ae0

8 files changed

Lines changed: 41 additions & 12 deletions

File tree

‎docs/notes/bugfix-15034.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
# import snapshot does not work correctly on 64-bit Linux.

‎engine/src/dskw32.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4060,7 +4060,7 @@ struct MCWindowsDesktop: public MCSystemInterface, public MCWindowsSystemService
40604060
uint32_t t_buf_size;
40614061
bool t_success;
40624062

4063-
t_success = MCS_closetakingbuffer(MCprocesses[index].ohandle, t_buffer, t_buf_size) == IO_NORMAL;
4063+
t_success = MCS_closetakingbuffer_uint32(MCprocesses[index].ohandle, t_buffer, t_buf_size) == IO_NORMAL;
40644064
MCprocesses[index].ohandle = nil;
40654065

40664066
IO_cleanprocesses();

‎engine/src/exec-interface.cpp‎

Lines changed: 14 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3648,23 +3648,31 @@ void MCInterfaceExportBitmap(MCExecContext &ctxt, MCImageBitmap *p_bitmap, int p
36483648
}
36493649

36503650
IO_handle t_stream = nil;
3651-
/* UNCHECKED */ t_stream = MCS_fakeopenwrite();
3652-
t_success = MCImageExport(p_bitmap, (Export_format)p_format, t_ps_ptr, p_dither, p_metadata, t_stream, nil);
3651+
t_stream = MCS_fakeopenwrite();
3652+
if (t_stream == nil)
3653+
t_success = false;
3654+
if (t_success)
3655+
t_success = MCImageExport(p_bitmap, (Export_format)p_format, t_ps_ptr, p_dither, p_metadata, t_stream, nil);
36533656

36543657
MCAutoByteArray t_autobuffer;
36553658
void *t_buffer = nil;
36563659
size_t t_size = 0;
3657-
MCS_closetakingbuffer(t_stream, t_buffer, t_size);
3658-
t_autobuffer.Give((char_t*)t_buffer, t_size);
3660+
if (t_success &&
3661+
MCS_closetakingbuffer(t_stream, t_buffer, t_size) != IO_NORMAL)
3662+
t_success = false;
3663+
3664+
if (t_success)
3665+
t_autobuffer.Give((char_t*)t_buffer, t_size);
36593666

3667+
if (t_success)
3668+
t_success = t_autobuffer.CreateDataAndRelease(r_data);
3669+
36603670
if (!t_success)
36613671
{
36623672
ctxt.LegacyThrow(EE_EXPORT_CANTWRITE);
36633673

36643674
return;
36653675
}
3666-
3667-
/* UNCHECKED */ t_autobuffer.CreateDataAndRelease(r_data);
36683676
}
36693677

36703678
void MCInterfaceExportBitmapToFile(MCExecContext& ctxt, MCImageBitmap *p_bitmap, int p_format, MCInterfaceImagePaletteSettings *p_palette, bool p_dither, MCImageMetadata* p_metadata, MCStringRef p_filename, MCStringRef p_mask_filename)

‎engine/src/ifile.cpp‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@ bool MCImageCompress(MCImageBitmap *p_bitmap, bool p_dither, MCImageCompressedBi
6969
else
7070
{
7171
uint32_t t_compression;
72-
char *t_buffer = nil;
72+
void *t_buffer = nil;
7373
uindex_t t_size = 0;
7474

7575
IO_handle t_stream = nil;
@@ -94,7 +94,7 @@ bool MCImageCompress(MCImageBitmap *p_bitmap, bool p_dither, MCImageCompressedBi
9494
}
9595

9696
if (t_stream != nil)
97-
t_success = MCS_closetakingbuffer(t_stream, reinterpret_cast<void*&>(t_buffer), reinterpret_cast<size_t&>(t_size)) == IO_NORMAL;
97+
t_success = MCS_closetakingbuffer_uint32(t_stream, t_buffer, t_size) == IO_NORMAL;
9898

9999
if (t_success)
100100
t_success = MCImageCreateCompressedBitmap(t_compression, r_compressed);

‎engine/src/iutil.cpp‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1236,15 +1236,15 @@ bool MCImageCreateClipboardData(MCImageBitmap *p_bitmap, MCDataRef &r_data)
12361236
MCImageBitmap *t_bitmap = nil;
12371237
IO_handle t_stream = nil;
12381238

1239-
char *t_bytes = nil;
1239+
void *t_bytes = nil;
12401240
uindex_t t_byte_count = 0;
12411241

12421242
t_success = nil != (t_stream = MCS_fakeopenwrite());
12431243

12441244
if (t_success)
12451245
t_success = MCImageEncodePNG(p_bitmap, nil, t_stream, t_byte_count);
12461246

1247-
if (t_stream != nil && IO_NORMAL != MCS_closetakingbuffer(t_stream, reinterpret_cast<void*&>(t_bytes), reinterpret_cast<size_t&>(t_byte_count)))
1247+
if (t_stream != nil && IO_NORMAL != MCS_closetakingbuffer_uint32(t_stream, t_bytes, t_byte_count))
12481248
t_success = false;
12491249

12501250
if (t_success)

‎engine/src/mcio.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -182,6 +182,7 @@ extern IO_handle MCS_fakeopen(const void *p_data, uindex_t p_size);
182182
extern IO_handle MCS_fakeopenwrite(void);
183183
///* LEGACY */ extern IO_stat MCS_fakeclosewrite(IO_handle &stream, char*& r_buffer, uint4& r_length);
184184
extern IO_stat MCS_closetakingbuffer(IO_handle& p_stream, void*& r_buffer, size_t& r_length);
185+
extern IO_stat MCS_closetakingbuffer_uint32(IO_handle& p_stream, void*& r_buffer, uint32_t& r_length);
185186

186187
extern IO_handle MCS_deploy_open(MCStringRef path, intenum_t p_mode);
187188
/* LEGACY */ extern IO_handle MCS_open(const char *path, const char *mode, Boolean map, Boolean driver, uint4 offset);

‎engine/src/sysspec.cpp‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1092,6 +1092,25 @@ IO_stat MCS_closetakingbuffer(IO_handle& p_stream, void*& r_buffer, size_t& r_le
10921092
return IO_NORMAL;
10931093
}
10941094

1095+
IO_stat MCS_closetakingbuffer_uint32(IO_handle& p_stream, void*& r_buffer, uint32_t& r_length)
1096+
{
1097+
size_t t_size;
1098+
void *t_buffer;
1099+
if (MCS_closetakingbuffer(p_stream, t_buffer, t_size) != IO_NORMAL)
1100+
return IO_ERROR;
1101+
1102+
if (t_size > UINT32_MAX)
1103+
{
1104+
free(t_buffer);
1105+
return IO_ERROR;
1106+
}
1107+
1108+
r_buffer = t_buffer;
1109+
r_length = (uint32_t)t_size;
1110+
1111+
return IO_NORMAL;
1112+
}
1113+
10951114
IO_stat MCS_writeat(const void *p_buffer, uint32_t p_size, uint32_t p_pos, IO_handle p_stream)
10961115
{
10971116
uint64_t t_old_pos;

‎engine/src/w32transfer.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1254,7 +1254,7 @@ bool MCWindowsPasteboard::Fetch(MCTransferType p_type, MCDataRef& r_data)
12541254
t_success = MCImageEncodePNG(t_bitmap, NULL, t_stream, t_byte_count);
12551255

12561256
if (t_success)
1257-
t_success = IO_NORMAL == MCS_closetakingbuffer(t_stream, *(void**)(&t_buffer), t_length);
1257+
t_success = IO_NORMAL == MCS_closetakingbuffer_uint32(t_stream, *(void**)(&t_buffer), t_length);
12581258

12591259
if (t_success)
12601260
t_success = MCDataCreateWithBytesAndRelease((char_t*)t_buffer, t_length, &t_out_data);

0 commit comments

Comments
 (0)