Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ACRE2 sys_prc148 causes input buffer overflow #89

Closed
jonpas opened this issue Nov 20, 2018 · 7 comments
Closed

ACRE2 sys_prc148 causes input buffer overflow #89

jonpas opened this issue Nov 20, 2018 · 7 comments

Comments

@jonpas
Copy link
Contributor

jonpas commented Nov 20, 2018

Version: 8b88b46

  PBO  @acre2/addons/acre_sys_prc148.pbo
input buffer overflow, can't enlarge buffer because scanner uses REJECT

No header files in that component were changed since I could last build it just fine, seems like a change in armake causes it.

@dedmen
Copy link
Contributor

dedmen commented Nov 20, 2018

Do you have a array value in there which total length is > 8kb?
Problem is. After parsing a array element you are left with , "next element", "next element" and so on
Now. The parser sees the comma, knows that it has a comma pattern and that it matches perfectly. BUT! The parser has to choose the longest matching pattern. So instead of grabbing the comma as it should. It instead tries the unquoted string pattern
https://github.com/KoffeinFlummi/armake/blob/master/src/rapify.l#L110
But it doesn't find the end of that until his 8kb buffer (16kb on 64 bit afaik) runs out.

I have a fix ready.
[^;,{"' \t\n][^;{\n]*/[ \t\n]*; { in line 110, in the link I posted above. Can you try that out?
I'll test if my change has anything to do with that though.

@jonpas
Copy link
Contributor Author

jonpas commented Nov 20, 2018

As said, nothing is changed in that component since last time I tried, but if could've also been broken then and I forgot to make an issue.

Will try.

@dedmen
Copy link
Contributor

dedmen commented Nov 20, 2018

Okey. Reverting my parser fix makes the error show up again on my test config (Arma AIO export).
Additionally reverting my preprocessor skip quoted strings thing, error still shows up.
Adding my parser fix back, and leaving the preprocessor change out, runs through successfully without error.

Which version of armake did you use previously?
I cannot test old versions with my AIO test because of #90

But with my test config (see attachment) original armake does indeed error. So it's not caused by my change.
test.zip

@jonpas
Copy link
Contributor Author

jonpas commented Nov 20, 2018

I think it was 0.6.1. But I'd have to make sure it actually worked with that.

@dedmen
Copy link
Contributor

dedmen commented Nov 20, 2018

Yes. That's the bug you had.
Your huge array is here: https://github.com/IDI-Systems/acre2/blob/master/addons/sys_prc148/config.cpp#L7
Do you need to have all your ID's in there? for TFAR I only have the base radios. I don't need the others to be placeable in editor or accessible in arsenal or anything anyway.
You have them as scope = 1 anyway. I think CfgPatches should only contain things that are actually supposed to be accessible.
But you are duplicating your whole config class for your radios
https://github.com/IDI-Systems/acre2/blob/f8bd42f9c504e9028154e5505ffb2d57d0e89cff/addons/main/script_radio_macro.hpp#L533
512 times. Even though there is no difference between them. You could reduce your filesize (and increase binarization speed) alot by just doing
class radio_2 : radio_1 {};
class radio_3 : radio_1 {};
class radio_4 : radio_1 {};
and so on for the rest of the classes.

@jonpas
Copy link
Contributor Author

jonpas commented Nov 20, 2018

I don't think they are supposed to be there yeah, but without it I wouldn't find this bug! :D

@dedmen
Copy link
Contributor

dedmen commented Nov 20, 2018

Well I found the bug last week already anyway :D
dedmen@8508357
Just didn't get to making pull requests for my fixes here

@jonpas jonpas changed the title ACRE2 sys_prc148 causes input b uffer overflow ACRE2 sys_prc148 causes input buffer overflow Nov 20, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants