Skip to content

Commit beaaccd

Browse files
committed
change RemoveFromString() to hopefully not access out of bounds memory (olivia ran into this)
1 parent 7502325 commit beaaccd

File tree

1 file changed

+13
-12
lines changed

1 file changed

+13
-12
lines changed

addons/sourcemod/scripting/shavit-chat.sp

Lines changed: 13 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1460,24 +1460,25 @@ public void SQL_GetChat_Callback(Database db, DBResultSet results, const char[]
14601460
}
14611461
}
14621462

1463-
void RemoveFromString(char[] buf, char[] thing, int extra)
1463+
void RemoveFromString(char[] buf, const char[] prefix, int extra_len)
14641464
{
1465-
int index, len = strlen(buf);
1466-
extra += strlen(thing);
1465+
int index;
1466+
extra_len += strlen(prefix);
14671467

1468-
while ((index = StrContains(buf, thing, true)) != -1)
1468+
while ((index = StrContains(buf, prefix, true)) != -1)
14691469
{
1470-
// Search sequence is in the end of the string, so just cut it and exit
1471-
if(index + extra >= len)
1470+
int remaining = strlen(buf[index]);
1471+
1472+
if (remaining > extra_len)
14721473
{
1473-
buf[index] = '\0';
1474-
break;
1474+
for (int i = 0; i < remaining-extra_len+1; ++i)
1475+
{
1476+
buf[index+i] = buf[index+i+extra_len];
1477+
}
14751478
}
1476-
1477-
while (buf[index] != 0)
1479+
else
14781480
{
1479-
buf[index] = buf[index+extra];
1480-
++index;
1481+
buf[index] = '\0';
14811482
}
14821483
}
14831484
}

0 commit comments

Comments
 (0)