AstralTransRocketries/ClassiCube
1
0
Fork 0
mirror of https://github.com/ClassiCube/ClassiCube.git synced 2025-09-13 09:35:23 -04:00
Code Issues Packages Projects Releases Wiki Activity

What's operator precedence anyways?

Browse Source 
Fixes game crashing due to heap corruption due to reading dst_height from wrong address (which would set dst_height to e.g. 7387141), which would then cause img_height to be set to 150, which would hence write to memory used by other data (as destination bitmap was actually only 64 pixels tall)
This commit is contained in:
UnknownShadow200 2021-12-08 12:22:26 +11:00
parent 7477751096
commit ecd733cd31
1 changed files with 6 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/interop_web.js
View File

@ -852,9 +852,10 @@ mergeInto(LibraryManager.library, {
ctx.fillStyle = "#000000";
ctx.fillText(text, 0, 0);
var dst_pixels = HEAP32[(bmp|0 + 0)>>2];
var dst_width = HEAP32[(bmp|0 + 4)>>2];
var dst_height = HEAP32[(bmp|0 + 8)>>2];
bmp = bmp|0;
var dst_pixels = HEAP32[(bmp + 0|0)>>2];
var dst_width = HEAP32[(bmp + 4|0)>>2];
var dst_height = HEAP32[(bmp + 8|0)>>2];
// TODO not all of it
var src = ctx.getImageData(0, 0, ctx.canvas.width, ctx.canvas.height);