EQEmulator Forums

EQEmulator Forums (https://www.eqemulator.org/forums/index.php)
-   Development::Server Code Submissions (https://www.eqemulator.org/forums/forumdisplay.php?f=669)
-   -   array index error (https://www.eqemulator.org/forums/showthread.php?t=25410)

Congdar 06-06-2008 12:53 PM

array index error
 
In spell_effects.cpp there are a couple of lines that were introduced with the Enchanter rune patch that can be called with a negative array index.
I noticed this call was being made for Necromancers casting their pet spell, but that is likely not the only case this happens.
The pet spell fails the if((CalcBuffDuration(caster,this,spell_id)-1) != 0) and goes to the else assigning buffslot = -2
then the initialization to 0 of the buffs array for melee_rune and magic_rune is where buffslot(-2) is used on the array. This had the effect
of setting Agility and Dexterity to 0 on the server side for the Necromancer, but didn't crash anything.

Code:

bool Mob::SpellEffect(Mob* caster, int16 spell_id, float partial)
{
    _ZP(Mob_SpellEffect);

    int caster_level, buffslot, effect, effect_value, i;
    ItemInst *SummonedItem=NULL;
#ifdef SPELL_EFFECT_SPAM
#define _EDLEN        200
    char effect_desc[_EDLEN];
#endif

    if(!IsValidSpell(spell_id))
        return false;

    const SPDat_Spell_Struct &spell = spells[spell_id];

    if((CalcBuffDuration(caster,this,spell_id)-1) != 0){
        buffslot = AddBuff(caster, spell_id);
        if(buffslot == -1)        // stacking failure
            return false;
    } else {
        buffslot = -2;        //represents not a buff I guess
    }

    caster_level = caster ? caster->GetCasterLevel(spell_id) : GetCasterLevel(spell_id);

#ifdef SPELL_EFFECT_SPAM
        Message(0, "You are affected by spell '%s' (id %d)", spell.name, spell_id);
        if(buffslot >= 0)
        {
            Message(0, "Buff slot:  %d  Duration:  %d tics", buffslot, buffs[buffslot].ticsremaining);
        }
#endif

        buffs[buffslot].melee_rune = 0;
        buffs[buffslot].magic_rune = 0;

I think it's just a simple fix of surrounding these two lines with an if check for safe array indexing
Code:

    if(buffslot >= 0) {
        buffs[buffslot].melee_rune = 0;
        buffs[buffslot].magic_rune = 0;
    }


Scorpious2k 06-18-2008 07:36 PM

This will be in version 1113.


All times are GMT -4. The time now is 06:12 AM.

Powered by vBulletin®, Copyright ©2000 - 2025, Jelsoft Enterprises Ltd.