From 4bb129ee40abebeca37513749b704ccc02e7cd16 Mon Sep 17 00:00:00 2001
From: ac_stef <ac_stef@users.sourceforge.net>
Date: Mon, 12 Jan 2009 15:19:12 +0000
Subject: [PATCH] limit number of map entities

git-svn-id: svn://svn.code.sf.net/p/actiongame/code/trunk/ac@4127 e016b1c5-ed68-44aa-a2f7-31cac88cffde
---
 source/src/tools.cpp   | 4 ++--
 source/src/world.h     | 3 ++-
 source/src/worldio.cpp | 9 ++++++++-
 3 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/source/src/tools.cpp b/source/src/tools.cpp
index 0235db9b..82931202 100644
--- a/source/src/tools.cpp
+++ b/source/src/tools.cpp
@@ -26,7 +26,7 @@ char *getregszvalue(HKEY root, const char *keystr, const char *query)
         {
             char *val = new char[len];
             long result = RegQueryValueEx(key, query, 0, &type, (uchar *)val, &len);
-            if(result==ERROR_SUCCESS) 
+            if(result==ERROR_SUCCESS)
             {
                 RegCloseKey(key);
                 val[len-1] = '\0';
@@ -327,7 +327,7 @@ mapstats *loadmapstats(const char *filename)
     memset(&s.hdr, 0, sizeof(header));
     if(gzread(f, &s.hdr, sizeof(header)-sizeof(int)*16)!=sizeof(header)-sizeof(int)*16 || (strncmp(s.hdr.head, "CUBE", 4) && strncmp(s.hdr.head, "ACMP",4))) { gzclose(f); return NULL; }
     endianswap(&s.hdr.version, sizeof(int), 4);
-    if(s.hdr.version>MAPVERSION || (s.hdr.version>=4 && gzread(f, &s.hdr.waterlevel, sizeof(int)*16)!=sizeof(int)*16)) { gzclose(f); return false; }
+    if(s.hdr.version>MAPVERSION || s.hdr.numents > MAXENTITIES || (s.hdr.version>=4 && gzread(f, &s.hdr.waterlevel, sizeof(int)*16)!=sizeof(int)*16)) { gzclose(f); return NULL; }
     if(s.hdr.version>=4) endianswap(&s.hdr.waterlevel, sizeof(int), 1); else s.hdr.waterlevel = -100000;
     entity e;
     enttypes = new uchar[s.hdr.numents];
diff --git a/source/src/world.h b/source/src/world.h
index 6c3c2249..0fe64098 100644
--- a/source/src/world.h
+++ b/source/src/world.h
@@ -109,6 +109,7 @@ struct mapstats
 #define SMALLEST_FACTOR 6               // determines number of mips there can be
 #define DEFAULT_FACTOR 8
 #define LARGEST_FACTOR 11               // 10 is already insane
+#define MAXENTITIES 65535
 #define SOLID(x) ((x)->type==SOLID)
 #define MINBORD 2                       // 2 cubes from the edge of the world are always solid
 #define OUTBORD(x,y) ((x)<MINBORD || (y)<MINBORD || (x)>=ssize-MINBORD || (y)>=ssize-MINBORD)
@@ -117,6 +118,6 @@ struct mapstats
 struct block { int x, y, xs, ys; };
 
 // vertex array format
-    
+
 struct vertex { float u, v, x, y, z; uchar r, g, b, a; };
 
diff --git a/source/src/worldio.cpp b/source/src/worldio.cpp
index 1f1104e2..8eadbe70 100644
--- a/source/src/worldio.cpp
+++ b/source/src/worldio.cpp
@@ -195,14 +195,21 @@ void save_world(char *mname)
     hdr.version = MAPVERSION;
     hdr.numents = 0;
     loopv(ents) if(ents[i].type!=NOTUSED) hdr.numents++;
+    if(hdr.numents > MAXENTITIES)
+    {
+        conoutf("too many map entities (%d), only %d will be written to file", hdr.numents, MAXENTITIES);
+        hdr.numents = MAXENTITIES;
+    }
     header tmp = hdr;
     endianswap(&tmp.version, sizeof(int), 4);
     endianswap(&tmp.waterlevel, sizeof(int), 1);
     gzwrite(f, &tmp, sizeof(header));
+    int ne = hdr.numents;
     loopv(ents)
     {
         if(ents[i].type!=NOTUSED)
         {
+            if(!ne--) break;
             entity tmp = ents[i];
             endianswap(&tmp, sizeof(short), 4);
             gzwrite(f, &tmp, sizeof(persistent_entity));
@@ -284,7 +291,7 @@ bool load_world(char *mname)        // still supports all map formats that have
     endianswap(&tmp.version, sizeof(int), 4);
     if(strncmp(tmp.head, "CUBE", 4)!=0 && strncmp(tmp.head, "ACMP",4)!=0) { conoutf("\f3while reading map: header malformatted"); gzclose(f); return false; }
     if(tmp.version>MAPVERSION) { conoutf("\f3this map requires a newer version of cube"); gzclose(f); return false; }
-    if(tmp.sfactor<SMALLEST_FACTOR || tmp.sfactor>LARGEST_FACTOR) { conoutf("\f3illegal map size"); gzclose(f); return false; }
+    if(tmp.sfactor<SMALLEST_FACTOR || tmp.sfactor>LARGEST_FACTOR || tmp.numents > MAXENTITIES) { conoutf("\f3illegal map size"); gzclose(f); return false; }
     if(tmp.version>=4 && gzread(f, &tmp.waterlevel, sizeof(int)*16)!=sizeof(int)*16) { conoutf("\f3while reading map: header malformatted"); gzclose(f); return false; }
     hdr = tmp;
     loadingscreen();