zakarya/puzzles
1
0
Fork 0
mirror of git://git.tartarus.org/simon/puzzles.git synced 2025-04-21 16:05:44 -07:00
Code Issues Packages Projects Releases Wiki Activity

Validate that save file values are ASCII (mostly)

Browse Source 
Apart from "SEED" records, all values in save files generated by Puzzles
should be printable ASCII.  This is enforced by assertion in the saving
code.  However, if a save file with non-ASCII move strings (for
instance) manages to get loaded then these non-ASCII values can cause an
assertion failure on saving.  Instead, the loading code now checks
values for ASCIIness.

This will not only avoid problems when re-saving files, but will also
defend the various internal parsers from at least some evil strings.  It
shouldn't invalidate any save files actually generated by Puzzles, but
it will sadly invalidate some of my fuzzing corpus.
This commit is contained in:
Ben Harris
2023-02-12 23:04:12 +00:00
parent ffe2fa169f
commit c3a5a7842e
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
midend.c
View File

@ -2329,6 +2329,13 @@ static const char *midend_deserialise_internal(
goto cleanup; goto cleanup;
} }
val[len] = '\0'; val[len] = '\0';
/* Validate that all values (apart from SEED) are printable ASCII. */
if (strcmp(key, "SEED"))
for (i = 0; val[i]; i++)
if (val[i] < 32 || val[i] >= 127) {
ret = "Forbidden characters in saved game file";
goto cleanup;
}
if (!started) { if (!started) {
if (strcmp(key, "SAVEFILE") || strcmp(val, SERIALISE_MAGIC)) { if (strcmp(key, "SAVEFILE") || strcmp(val, SERIALISE_MAGIC)) {