xbedump fix for array out of bounds access

"loser" <[email protected]> Sat, 7 Jan 2006 02:47:35 +1100
Newsgroups gmane.linux.ports.xbox.devel
Message-ID <003d01c612d8$83edbf30$0300a8c0@shitbox>
hi all

here is a fix for the function gigimport() in xboxlib.c from xbedump.
i noticed that it wasn't performing a successful validation when i compiled the source in 'deug configuration' in visual studio. turns out there was some out of bounds array access. i fixed this as well as allowing the gigimport() function to now support numbers that are not even multiple of bytes. (although currently all numbers used with it ARE even numbers of bytes, but fixed it just in case...)

here is the function below from xboxlib.c, it is also included in a separete text file:


void gigimport(giant g, unsigned char *buff, int len) {

 // copy buffered 'number' into giant's number buffer
 int count;
 memcpy(g->n,buff,len);
 
 // the giants number buffer stores large numbers as
 // multiple 16bit numbers, so if the length of our buffer is odd
 // our number wont fit properly.
 // to fix this we add a trailing 0x00 byte
 if(len & 1)
 {
  *((unsigned char*)(g->n)+len) = 0x00;
  len++;
 }
 g->sign = len/2;
 
 if (g->sign == 0)
 {
  g->sign = 1;
  *((unsigned char*)(g->n)) = 0x00;
 }
}


(sorry no patch tools installed here)
cya
loser
xbedump_fix.c (text/plain, 512 B)
void gigimport(giant g, unsigned char *buff, int len) {

	// copy buffered 'number' into giant's number buffer
	int count;
	memcpy(g->n,buff,len);
	
	// the giants number buffer stores large numbers as
	// multiple 16bit numbers, so if the length of our buffer is odd
	// our number wont fit properly.
	// to fix this we add a trailing 0x00 byte
	if(len & 1)
	{
		*((unsigned char*)(g->n)+len) = 0x00;
		len++;
	}
	g->sign = len/2;
	
	if (g->sign == 0)
	{
		g->sign = 1;
		*((unsigned char*)(g->n)) = 0x00;
	}
}