Skip to content

Commit 3a5124d

Browse files
CookStarCookStar
committed
Changed instance/pointer_attribute to accept length when using string_array to prevent buffer overrun.
1 parent 029391b commit 3a5124d

File tree

8 files changed

+85
-6
lines changed

8 files changed

+85
-6
lines changed

‎addons/source-python/data/source-python/entities/csgo/CCSPlayer.ini‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,7 @@ srv_check = False
7373
base = m_flGroundAccelLinearFracLastTime
7474
offset = 140
7575
type = STRING_ARRAY
76+
length = 16
7677

7778

7879
[property]

‎addons/source-python/data/source-python/entities/orangebox/cstrike/CCSPlayer.ini‎

100644100755
Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,7 @@
6262
offset_windows = 5628
6363
offset_linux = 5648
6464
type = STRING_ARRAY
65+
length = 16
6566

6667

6768
[based_attribute]
@@ -75,6 +76,7 @@
7576
base = m_flFlashDuration
7677
offset = -28
7778
type = STRING_ARRAY
79+
length = 16
7880

7981

8082
[property]

‎addons/source-python/data/source-python/weapons/scripts/WeaponInfo.ini‎

100644100755
Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,3 +27,4 @@
2727
[[class_name]]
2828
type = STRING_ARRAY
2929
offset = 6
30+
length = 80

‎addons/source-python/data/source-python/weapons/scripts/csgo/WeaponInfo.ini‎

100644100755
Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,22 +8,27 @@
88
[[print_name]]
99
type = STRING_ARRAY
1010
offset = 86
11+
length = 80
1112

1213
[[view_model_name]]
1314
type = STRING_ARRAY
1415
offset = 166
16+
length = 80
1517

1618
[[world_model_name]]
1719
type = STRING_ARRAY
1820
offset = 246
21+
length = 80
1922

2023
[[primary_ammo_type]]
2124
type = STRING_ARRAY
2225
offset = 326
26+
length = 32
2327

2428
[[animation_prefix]]
2529
type = STRING_ARRAY
2630
offset = 438
31+
length = 16
2732

2833
[[bucket]]
2934
type = INT
@@ -72,14 +77,17 @@
7277
[[secondary_ammo_type]]
7378
type = STRING_ARRAY
7479
offset = 496
80+
length = 32
7581

7682
[[ai_addon_base]]
7783
type = STRING_ARRAY
7884
offset = 528
85+
length = 80
7986

8087
[[ai_addon]]
8188
type = STRING_ARRAY
8289
offset = 608
90+
length = 80
8391

8492
[[primary_ammo_index]]
8593
type = INT
@@ -180,6 +188,7 @@
180188
[[heat_effect_name]]
181189
type = STRING_ARRAY
182190
offset = 2096
191+
length = 80
183192

184193
[[smoke_color]]
185194
type = Vector
@@ -188,18 +197,22 @@
188197
[[muzzle_flash_effect_1stperson]]
189198
type = STRING_ARRAY
190199
offset = 2188
200+
length = 80
191201

192202
[[muzzle_flash_effect_3rdperson]]
193203
type = STRING_ARRAY
194204
offset = 2268
205+
length = 80
195206

196207
[[eject_brass_effect]]
197208
type = STRING_ARRAY
198209
offset = 2348
210+
length = 80
199211

200212
[[tracer_effect]]
201213
type = STRING_ARRAY
202214
offset = 2428
215+
length = 80
203216

204217
[[tracer_frequency]]
205218
type = INT
@@ -368,10 +381,12 @@
368381
[[zoom_in_sound_name]]
369382
type = STRING_ARRAY
370383
offset = 3705
384+
length = 80
371385

372386
[[zoom_out_sound_name]]
373387
type = STRING_ARRAY
374388
offset = 3785
389+
length = 80
375390

376391
[[bot_audible_range]]
377392
type = FLOAT
@@ -384,26 +399,32 @@
384399
[[wrong_team_message]]
385400
type = STRING_ARRAY
386401
offset = 3873
402+
length = 32
387403

388404
[[player_animation_extension]]
389405
type = STRING_ARRAY
390406
offset = 3905
407+
length = 16
391408

392409
[[shield_view_model_name]]
393410
type = STRING_ARRAY
394411
offset = 3921
412+
length = 64
395413

396414
[[addon_model_name]]
397415
type = STRING_ARRAY
398416
offset = 3985
417+
length = 80
399418

400419
[[addon_location_name]]
401420
type = STRING_ARRAY
402421
offset = 4065
422+
length = 80
403423

404424
[[silencer_model_name]]
405425
type = STRING_ARRAY
406426
offset = 4145
427+
length = 80
407428

408429
[[addon_scale]]
409430
type = FLOAT

‎addons/source-python/data/source-python/weapons/scripts/orangebox/WeaponInfo.ini‎

100644100755
Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,14 +8,17 @@
88
[[print_name]]
99
type = STRING_ARRAY
1010
offset = 86
11+
length = 80
1112

1213
[[world_model]]
1314
type = STRING_ARRAY
1415
offset = 166
16+
length = 80
1517

1618
[[animation_prefix]]
1719
type = STRING_ARRAY
1820
offset = 326
21+
length = 16
1922

2023
[[slot_index]]
2124
type = INT
@@ -64,70 +67,87 @@
6467
[[primary_ammo_name]]
6568
type = STRING_ARRAY
6669
offset = 384
70+
length = 32
6771

6872
[[secondary_ammo_name]]
6973
type = STRING_ARRAY
7074
offset = 416
75+
length = 32
7176

7277
[[empty_sound]]
7378
type = STRING_ARRAY
7479
offset = 448
80+
length = 80
7581

7682
[[single_sound]]
7783
type = STRING_ARRAY
7884
offset = 528
85+
length = 80
7986

8087
[[single_npc_sound]]
8188
type = STRING_ARRAY
8289
offset = 608
90+
length = 80
8391

8492
[[double_sound]]
8593
type = STRING_ARRAY
8694
offset = 688
95+
length = 80
8796

8897
[[double_npc_sound]]
8998
type = STRING_ARRAY
9099
offset = 768
100+
length = 80
91101

92102
[[burst_sound]]
93103
type = STRING_ARRAY
94104
offset = 848
105+
length = 80
95106

96107
[[reload_sound]]
97108
type = STRING_ARRAY
98109
offset = 928
110+
length = 80
99111

100112
[[reload_npc_sound]]
101113
type = STRING_ARRAY
102114
offset = 1008
115+
length = 80
103116

104117
[[melee_miss_sound]]
105118
type = STRING_ARRAY
106119
offset = 1088
120+
length = 80
107121

108122
[[melee_hit_sound]]
109123
type = STRING_ARRAY
110124
offset = 1168
125+
length = 80
111126

112127
[[melee_hit_world_sound]]
113128
type = STRING_ARRAY
114129
offset = 1248
130+
length = 80
115131

116132
[[special_sound_1]]
117133
type = STRING_ARRAY
118134
offset = 1328
135+
length = 80
119136

120137
[[special_sound_2]]
121138
type = STRING_ARRAY
122139
offset = 1408
140+
length = 80
123141

124142
[[special_sound_3]]
125143
type = STRING_ARRAY
126144
offset = 1488
145+
length = 80
127146

128147
[[taunt_sound]]
129148
type = STRING_ARRAY
130149
offset = 1568
150+
length = 80
131151

132152
[[primary_ammo_type]]
133153
type = INT
@@ -196,3 +216,4 @@
196216
[[ai_addon]]
197217
type = STRING_ARRAY
198218
offset = 1704
219+
length = 80

‎addons/source-python/data/source-python/weapons/scripts/orangebox/cstrike/WeaponInfo.ini‎

100644100755
Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,26 +50,32 @@ size = 2320
5050
[[wrong_team_message]]
5151
type = STRING_ARRAY
5252
offset = 1817
53+
length = 32
5354

5455
[[player_animation_extension]]
5556
type = STRING_ARRAY
5657
offset = 1849
58+
length = 16
5759

5860
[[shield_view_model]]
5961
type = STRING_ARRAY
6062
offset = 1865
63+
length = 64
6164

6265
[[addon_model]]
6366
type = STRING_ARRAY
6467
offset = 1929
68+
length = 80
6569

6670
[[dropped_model]]
6771
type = STRING_ARRAY
6872
offset = 2009
73+
length = 80
6974

7075
[[silencer_model]]
7176
type = STRING_ARRAY
7277
offset = 2089
78+
length = 80
7379

7480
[[muzzle_flash_style_index]]
7581
type = INT

‎addons/source-python/packages/source-python/memory/helpers.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -79,7 +79,7 @@ class Key(object):
7979
# Attribute/array keys
8080
TYPE_NAME = 'type'
8181

82-
# Array keys
82+
# Attribute(string length)/Array keys
8383
LENGTH = 'length'
8484

8585
# Pointer keys

‎addons/source-python/packages/source-python/memory/manager.py‎

Lines changed: 32 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -368,7 +368,8 @@ def create_type_from_dict(self, type_name, raw_data, bases=(CustomType,)):
368368
(
369369
(Key.TYPE_NAME, Key.as_attribute_type, NO_DEFAULT),
370370
(Key.OFFSET, Key.as_int, NO_DEFAULT),
371-
(Key.DOC, Key.as_str, None)
371+
(Key.DOC, Key.as_str, None),
372+
(Key.LENGTH, Key.as_int, 0)
372373
)
373374
)
374375

@@ -434,7 +435,7 @@ def create_type_from_dict(self, type_name, raw_data, bases=(CustomType,)):
434435
# Now create and register the type
435436
return self(type_name, bases, cls_dict)
436437

437-
def instance_attribute(self, type_name, offset, doc=None):
438+
def instance_attribute(self, type_name, offset, doc=None, length=0):
438439
"""Create a wrapper for an instance attribute.
439440
440441
Examples:
@@ -475,12 +476,22 @@ def fset(ptr, value):
475476
# Make sure the value will not deallocate as long as it is
476477
# part of this object
477478
ptr._pointer_values[offset] = string_pointer
479+
480+
# Handle string array type
481+
elif type_name == Type.STRING_ARRAY:
482+
if length and len(value) >= length:
483+
raise ValueError(
484+
'The string length exceeds'
485+
'the limit "{0}".'.format(length-1))
486+
487+
ptr.set_string_array(value, offset)
488+
478489
else:
479490
getattr(ptr, 'set_' + type_name)(value, offset)
480491

481492
return property(fget, fset, None, doc)
482493

483-
def pointer_attribute(self, type_name, offset, doc=None):
494+
def pointer_attribute(self, type_name, offset, doc=None, length=0):
484495
"""Create a wrapper for a pointer attribute.
485496
486497
Examples:
@@ -521,7 +532,12 @@ def fset(ptr, value):
521532
# Is there no space allocated?
522533
if not instance_ptr:
523534
# Allocate space for the value
524-
instance_ptr = alloc(TYPE_SIZES[type_name.upper()])
535+
if type_name == Type.STRING_ARRAY:
536+
size = length if length else len(value) + 1
537+
else:
538+
size = TYPE_SIZES[type_name.upper()]
539+
540+
instance_ptr = alloc(size)
525541

526542
# Add the pointer to the set, so there will be a reference
527543
# until the instance gets deleted
@@ -532,12 +548,23 @@ def fset(ptr, value):
532548

533549
# Handle string pointer type
534550
if type_name == Type.STRING_POINTER:
535-
string_pointer = instance_ptr.set_string_pointer(value, offset)
551+
string_pointer = instance_ptr.set_string_pointer(
552+
value, offset)
536553
string_pointer.auto_dealloc = True
537554

538555
# Make sure the value will not deallocate as long as it is
539556
# part of this object
540557
ptr._pointer_values[offset] = string_pointer
558+
559+
# Handle string array type
560+
elif type_name == Type.STRING_ARRAY:
561+
if length and len(value) >= length:
562+
raise ValueError(
563+
'The string length exceeds'
564+
'the limit "{0}".'.format(length-1))
565+
566+
instance_ptr.set_string_array(value, offset)
567+
541568
else:
542569
# Set the value
543570
getattr(instance_ptr, 'set_' + type_name)(value)

0 commit comments

Comments
 (0)