Re: TORCS + PLIB Buffer overflow detected

Hi Andres

So the fix would be then 2 parts:

> in grloadacc.cpp
>
> static int do_material ( char *s )
> {
>    char name [ 1024 ] ;
>    sgVec4 rgb  ;
>    sgVec4 amb  ;
>    sgVec4 emis ;
>    sgVec4 spec ;
>    int   shi ;
>    float trans ;
>
>    if ( sscanf ( s,
> "%s rgb %f %f %f amb %f %f %f emis %f %f %f spec %f %f %f shi %d trans %f",

So this should be then "%1023s ..., or less than 1023, right?

>      name,
> &rgb [0], &rgb [1], &rgb [2],
> &amb [0], &amb [1], &amb [2],
> &emis[0], &emis[1], &emis[2],
> &spec[0], &spec[1], &spec[2],
> &shi,
> &trans ) != 15 )
>    {

Here we leave the context, so the right place to fix this is plib. But 
we could also tune the format string (maybe we can get the buffer size 
somehow, but for getting the idea):

ulSetError ( UL_WARNING, "grloadac:do_material: Can't parse this 
MATERIAL:%1023s", s ) ;

Can you check if this does the trick? Did you already let the plib 
people know?

Thank you very much for your report and help

Best regards

Bernhard

------------------------------------------------------------------------------
Write once. Port to many.
Get the SDK and tools to simplify cross-platform app development. Create 
new or port existing apps to sell to consumers worldwide. Explore the 
Intel AppUpSM program developer opportunity. appdeveloper.intel.com/join
http://p.sf.net/sfu/intel-appdev