mmo-ref/tinymux
1
0
Fork 0
mirror of https://github.com/brazilofmux/tinymux synced 2026-08-13 00:23:11 -04:00
Code Issues Projects Releases Packages Wiki Activity

fix: comsys V0123 channel-name UTF-8 boundary backoff read wrong buffer (#841)

Browse source 
load_comsystem_V0123 converts the channel-name line to UTF-8 (pBufferUnicode,
updating nChannel), and when it exceeds MAX_CHANNEL_LEN backs off to a whole-
character boundary — but the backoff loop read temp (the pre-conversion line)
while the bytes copied come from pBufferUnicode. The header case just below does
it right (reads pBufferUnicode), so this was a copy-paste inconsistency.

Not memory-unsafe (nChannel <= 50 and temp is an LBUF, so in bounds; memcpy
count never exceeds pBufferUnicode), but loading a pre-2007 V0123 comsys file
with a channel name > 50 bytes after conversion could truncate the name mid-
character, leaving invalid UTF-8 in ch->name. Read pBufferUnicode[nChannel-1]
(matching the header path). Legacy load path only; smoke 1255/1255.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Stephen Dennis 2026-06-14 18:01:04 -06:00
parent 8922172209
commit 132c197e94
1 changed files with 5 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

6
mux/modules/engine/comsys.cpp
View file

@ -749,8 +749,12 @@ void load_comsystem_V0123(FILE* fp)
if (MAX_CHANNEL_LEN < nChannel)
{
nChannel = MAX_CHANNEL_LEN;
// Back off to a whole-character boundary in the CONVERTED buffer
// (pBufferUnicode), the data actually copied below — not temp, the
// pre-conversion line (the header case just below gets this right).
//
while (0 < nChannel
&& UTF8_CONTINUE <= utf8_FirstByte[temp[nChannel - 1]])
&& UTF8_CONTINUE <= utf8_FirstByte[static_cast<unsigned char>(pBufferUnicode[nChannel - 1])])
{
nChannel--;
}