cargo_iter_next() uses -1 array index

• Reporter: cazfi
• Owner: cazfi
• Type: Bugs
• Status: Closed
• Component: General
• MileStone: 3.0.8 (closed)
• Priority: 5 - Medium
• Severity: 5 - Medium
• Resolution: Fixed
• File: 2

Details

Reported by alain_bkr in https://osdn.net/projects/freeciv/ticket/47748#comment:12505:47748:1681095349 :

> ../../common/unit.c:2475:13: runtime error: index -1 out of bounds for type 'const struct unit_list_link *[5]'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ../../common/unit.c:2475:13 in

This was with S3_1.

Ticket History (3/8 Histories)

2023-04-22 19:29 Updated by: cazfi

• New Ticket "cargo_iter_next() uses -1 array index" created

2023-04-22 19:42 Updated by: cazfi

• File 0024-Fix-cargo_iter_next-out-of-bounds-read.patch (File ID: 12246) is attached

2023-04-22 19:43 Updated by: cazfi

• File 0046-Fix-cargo_iter_next-out-of-bounds-read.patch (File ID: 12247) is attached

2023-04-22 19:45 Updated by: cazfi

• Owner Update from (None) to cazfi
• Resolution Update from None to Accepted
• Milestone Update from (None) to 3.0.8 (closed)

Comment

The difference between attached patches is that main / S3_2 one adds an assert that more stable branches patch does not.

2023-04-23 02:57 Updated by: cazfi

Comment

S3_1/S3_0 patch also for S2_6.

2023-04-23 03:52 Updated by: cazfi

Comment

Likely duplicate -> #47661

2023-04-26 11:52 Updated by: cazfi

• Status Update from Open to Closed
• Resolution Update from Accepted to Fixed

2023-05-05 21:44 Updated by: alain_bkr

Comment

this does not fix the problem

#47982 has the complete fix

(Edited, 2023-05-05 21:46 Updated by: alain_bkr)