Skip to content

Commit 1d5868a

Browse files
committed
fix buffer overflow found by fuzzer
The buffer overflow happens much later, but it is caused by some logic trying to play move on a position where there's already a piece, which increments the disks_played variable above 61, which is then used as index to some array. Some plays doesn't invoke the buffer overflow, but only lead to inconsistent state.
1 parent a9106de commit 1d5868a

File tree

1 file changed

+10
-0
lines changed

1 file changed

+10
-0
lines changed

moves.c

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -220,6 +220,16 @@ game_in_progress( void ) {
220220

221221
INLINE int
222222
make_move( int side_to_move, int move, int update_hash ) {
223+
if (board[move] == 0 || board[move] == 2) {
224+
// This should be unreachable, but fuzzer found an instance where it happens:
225+
// -r 0 -l 9 6 3 5 19 0 -repeat 4 -p 1 -b 1 -w 0 -h 19 -dev 17 75 94.33498 -g tests/resources/board.txt -time 40 48 6 24
226+
// continuing here can lead to index out of bounds somewhere else, so we return 0 here.
227+
// That only causes fatal error in PV completion later
228+
return 0;
229+
}
230+
// we could replace the above if with these asserts, too
231+
// assert(board[move] != 0);
232+
// assert(board[move] != 2);
223233
int flipped;
224234
unsigned int diff1, diff2;
225235

0 commit comments

Comments
 (0)