Mirror/TrinityCore
1
0
Fork 0
mirror of https://github.com/TrinityCore/TrinityCore.git synced 2026-01-16 07:30:42 +01:00
Code Issues Packages Projects Releases Wiki Activity

Core/PathFinding: Fix buffer overflow

Browse Source 
(cherry picked from commit dc7856644f)
This commit is contained in:
jackpoz
2020-04-29 22:01:23 +02:00
committed by Shauren
parent 6c6b8cb1c6
commit 7d632d5711
1 changed files with 10 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
src/server/game/Movement/PathGenerator.cpp
View File

@@ -514,7 +514,9 @@ void PathGenerator::BuildPointPath(const float *startPoint, const float *endPoin
G3D::Vector3 prevVec = startVec;
float len = diffVec.length();
diffVec *= SMOOTH_PATH_STEP_SIZE / len;
while (len > SMOOTH_PATH_STEP_SIZE)
// If the path is short PATHFIND_SHORT will be set as type
while (len > SMOOTH_PATH_STEP_SIZE && pointCount < MAX_POINT_PATH_LENGTH)
{
len -= SMOOTH_PATH_STEP_SIZE;
prevVec += diffVec;
@@ -524,8 +526,12 @@ void PathGenerator::BuildPointPath(const float *startPoint, const float *endPoin
++pointCount;
}
memcpy(&pathPoints[VERTEX_SIZE * pointCount], endPoint, sizeof(float)* 3); // last point
++pointCount;
// If the path is short PATHFIND_SHORT will be set as type
if (pointCount < MAX_POINT_PATH_LENGTH)
{
memcpy(&pathPoints[VERTEX_SIZE * pointCount], endPoint, sizeof(float) * 3); // last point
++pointCount;
}
}
else if (_useStraightPath)
{
@@ -569,7 +575,7 @@ void PathGenerator::BuildPointPath(const float *startPoint, const float *endPoin
_type = PathType(_type | PATHFIND_NOPATH);
return;
}
else if (pointCount == _pointPathLimit)
else if (pointCount >= _pointPathLimit)
{
TC_LOG_DEBUG("maps.mmaps", "++ PathGenerator::BuildPointPath FAILED! path sized %d returned, lower than limit set to %d", pointCount, _pointPathLimit);
BuildShortcut();