From 4c443bce5cf042265099d5239d8958d2e61a6793 Mon Sep 17 00:00:00 2001 From: rubidium Date: Thu, 4 Jul 2013 16:36:47 +0000 Subject: [PATCH] (svn r25555) -Fix [FS#5632]: [Script] Texts from scripts were not validated before they were shown, causing an assertion to trigger --- src/script/api/script_text.cpp | 2 ++ src/script/script_info.cpp | 6 ++++++ src/script/squirrel.cpp | 2 ++ src/string.cpp | 12 ++++++++++++ src/string_func.h | 2 ++ 5 files changed, 24 insertions(+) diff --git a/src/script/api/script_text.cpp b/src/script/api/script_text.cpp index 577dd813e8..f87b2e8b28 100644 --- a/src/script/api/script_text.cpp +++ b/src/script/api/script_text.cpp @@ -72,6 +72,7 @@ SQInteger ScriptText::_SetParam(int parameter, HSQUIRRELVM vm) sq_getstring(vm, -1, &value); this->params[parameter] = strdup(SQ2OTTD(value)); + ValidateString(this->params[parameter]); break; } @@ -147,6 +148,7 @@ SQInteger ScriptText::_set(HSQUIRRELVM vm) const SQChar *key; sq_getstring(vm, 2, &key); const char *key_string = SQ2OTTD(key); + ValidateString(key_string); if (strncmp(key_string, "param_", 6) != 0 || strlen(key_string) > 8) return SQ_ERROR; k = atoi(key_string + 6); diff --git a/src/script/script_info.cpp b/src/script/script_info.cpp index a1db9e13e0..8b84966f23 100644 --- a/src/script/script_info.cpp +++ b/src/script/script_info.cpp @@ -126,12 +126,15 @@ SQInteger ScriptInfo::AddSetting(HSQUIRRELVM vm) const SQChar *sqkey; if (SQ_FAILED(sq_getstring(vm, -2, &sqkey))) return SQ_ERROR; const char *key = SQ2OTTD(sqkey); + ValidateString(key); if (strcmp(key, "name") == 0) { const SQChar *sqvalue; if (SQ_FAILED(sq_getstring(vm, -1, &sqvalue))) return SQ_ERROR; char *name = strdup(SQ2OTTD(sqvalue)); char *s; + ValidateString(name); + /* Don't allow '=' and ',' in configure setting names, as we need those * 2 chars to nicely store the settings as a string. */ while ((s = strchr(name, '=')) != NULL) *s = '_'; @@ -142,6 +145,7 @@ SQInteger ScriptInfo::AddSetting(HSQUIRRELVM vm) const SQChar *sqdescription; if (SQ_FAILED(sq_getstring(vm, -1, &sqdescription))) return SQ_ERROR; config.description = strdup(SQ2OTTD(sqdescription)); + ValidateString(config.description); items |= 0x002; } else if (strcmp(key, "min_value") == 0) { SQInteger res; @@ -227,6 +231,7 @@ SQInteger ScriptInfo::AddLabels(HSQUIRRELVM vm) const SQChar *sq_setting_name; if (SQ_FAILED(sq_getstring(vm, -2, &sq_setting_name))) return SQ_ERROR; const char *setting_name = SQ2OTTD(sq_setting_name); + ValidateString(setting_name); ScriptConfigItem *config = NULL; for (ScriptConfigItemList::iterator it = this->config_list.begin(); it != this->config_list.end(); it++) { @@ -255,6 +260,7 @@ SQInteger ScriptInfo::AddLabels(HSQUIRRELVM vm) const char *key_string = SQ2OTTD(sq_key); int key = atoi(key_string + 1); const char *label = SQ2OTTD(sq_label); + ValidateString(label); /* !Contains() prevents strdup from leaking. */ if (!config->labels->Contains(key)) config->labels->Insert(key, strdup(label)); diff --git a/src/script/squirrel.cpp b/src/script/squirrel.cpp index ed87d487cf..7c684d4b82 100644 --- a/src/script/squirrel.cpp +++ b/src/script/squirrel.cpp @@ -14,6 +14,7 @@ #include "../debug.h" #include "squirrel_std.hpp" #include "../fileio_func.h" +#include "../string_func.h" #include #include <../squirrel/sqpcheader.h> #include <../squirrel/sqvm.h> @@ -252,6 +253,7 @@ bool Squirrel::CallStringMethodStrdup(HSQOBJECT instance, const char *method_nam if (!this->CallMethod(instance, method_name, &ret, suspend)) return false; if (ret._type != OT_STRING) return false; *res = strdup(ObjectToString(&ret)); + ValidateString(*res); return true; } diff --git a/src/string.cpp b/src/string.cpp index b543ab868e..39fc8479c9 100644 --- a/src/string.cpp +++ b/src/string.cpp @@ -254,6 +254,18 @@ void str_validate(char *str, const char *last, StringValidationSettings settings *dst = '\0'; } +/** + * Scans the string for valid characters and if it finds invalid ones, + * replaces them with a question mark '?'. + * @param str the string to validate + */ +void ValidateString(const char *str) +{ + /* We know it is '\0' terminated. */ + str_validate(const_cast(str), str + strlen(str) + 1); +} + + /** * Checks whether the given string is valid, i.e. contains only * valid (printable) characters and is properly terminated. diff --git a/src/string_func.h b/src/string_func.h index 32d3d7e6a9..25608889dd 100644 --- a/src/string_func.h +++ b/src/string_func.h @@ -40,6 +40,8 @@ int CDECL seprintf(char *str, const char *last, const char *format, ...) WARN_FO char *CDECL str_fmt(const char *str, ...) WARN_FORMAT(1, 2); void str_validate(char *str, const char *last, StringValidationSettings settings = SVS_REPLACE_WITH_QUESTION_MARK); +void ValidateString(const char *str); + void str_fix_scc_encoded(char *str, const char *last); void str_strip_colours(char *str); bool strtolower(char *str);