AstralTransRocketries/ClassiCube
1
0
Fork 0
mirror of https://github.com/ClassiCube/ClassiCube.git synced 2025-09-12 17:17:09 -04:00
Code Issues Packages Projects Releases Wiki Activity

What's operator precedence anyways?

Browse Source 
Fixes game crashing due to heap corruption due to reading dst_height from wrong address (which would set dst_height to e.g. 7387141), which would then cause img_height to be set to 150, which would hence write to memory used by other data (as destination bitmap was actually only 64 pixels tall)
This commit is contained in:
UnknownShadow200 2021-12-08 12:22:26 +11:00
parent 7477751096
commit ecd733cd31
1 changed files with 6 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
src/interop_web.js
View File

@ -847,14 +847,15 @@ mergeInto(LibraryManager.library, {
var text = UTF8ArrayToString(HEAPU8, textStr, textLen);
var ctx = _interop_TextInit(font, fontSize);
ctx.fillStyle = "#ffffff";
ctx.fillStyle = "#ffffff";
ctx.fillRect(0, 0, ctx.canvas.width, ctx.canvas.height);
ctx.fillStyle = "#000000";
ctx.fillStyle = "#000000";
ctx.fillText(text, 0, 0);
var dst_pixels = HEAP32[(bmp|0 + 0)>>2];
var dst_width = HEAP32[(bmp|0 + 4)>>2];
var dst_height = HEAP32[(bmp|0 + 8)>>2];
bmp = bmp|0;
var dst_pixels = HEAP32[(bmp + 0|0)>>2];
var dst_width = HEAP32[(bmp + 4|0)>>2];
var dst_height = HEAP32[(bmp + 8|0)>>2];
// TODO not all of it
var src = ctx.getImageData(0, 0, ctx.canvas.width, ctx.canvas.height);