Fix crash (buffer overflow) when command line length exceeds 511.

digitall · Oct 11, 2014 · 1ef11cf · 1ef11cf
1 parent 3aa65f4
commit 1ef11cf
Show file tree

Hide file tree

Showing 4 changed files with 13 additions and 10 deletions.
diff --git a/src/xrCore/xrCore.cpp b/src/xrCore/xrCore.cpp
@@ -41,12 +41,11 @@ void xrCore::_initialize	(LPCSTR _ApplicationName, LogCallback cb, BOOL init_fs,
 #endif
 		// Init COM so we can use CoCreateInstance
 //		HRESULT co_res = 
-		if (!strstr(GetCommandLine(),"-editor"))
+        Params = xr_strdup(GetCommandLine());
+        xr_strlwr(Params);
+        if (!strstr(Params, "-editor"))
 			CoInitializeEx	(NULL, COINIT_MULTITHREADED);
 
-		xr_strcpy			(Params,sizeof(Params),GetCommandLine());
-		_strlwr_s			(Params,sizeof(Params));
-
 		string_path		fn,dr,di;
 
 		// application path
@@ -147,7 +146,7 @@ void xrCore::_destroy		()
 			xr_delete		(trained_model);
 		}
 #endif
-
+        xr_free(Params);
 		Memory._destroy		();
 	}
 }

diff --git a/src/xrCore/xrCore.h b/src/xrCore/xrCore.h
@@ -299,7 +299,7 @@ class XRCORE_API xrCore
 	string_path	WorkingPath;
 	string64	UserName;
 	string64	CompName;
-	string512	Params;
+    char* Params;
 	DWORD		dwFrame;
 
 public:

diff --git a/src/xrEngine/x_ray.cpp b/src/xrEngine/x_ray.cpp
@@ -1556,8 +1556,10 @@ void doBenchmark(LPCSTR name)
 		xr_strcpy				(g_sBenchmarkName, test_name);
 
 		test_command		= ini.r_string_wb("benchmark",test_name);
-		xr_strcpy			(Core.Params,*test_command);
-		_strlwr_s				(Core.Params);
+        u32 cmdSize = test_command.size()+1;
+        Core.Params = (char*)xr_realloc(Core.Params, cmdSize);
+        xr_strcpy(Core.Params, cmdSize, test_command.c_str());
+        xr_strlwr(Core.Params);
 
 		InitInput					();
 		if(i){

diff --git a/src/xrEngine/xrSASH.cpp b/src/xrEngine/xrSASH.cpp
@@ -136,8 +136,10 @@ void xrSASH::LoopNative()
 			//xr_strcpy(g_sBenchmarkName, test_name);
 
 			test_command = ini.r_string_wb("benchmark",test_name);
-			xr_strcpy( Core.Params, *test_command );
-			_strlwr_s( Core.Params );
+            u32 cmdSize = test_command.size()+1;
+            Core.Params = (char*)xr_realloc(Core.Params, cmdSize);
+            xr_strcpy(Core.Params, cmdSize, test_command.c_str());
+            xr_strlwr(Core.Params);
 
 			RunBenchmark(test_name);