From 0a609ba3f14ee00f9ccb95038c195772c5b5453d Mon Sep 17 00:00:00 2001
From: avolkov <avolkov@8092fc87-c524-0410-9efc-e669fe64eaf9>
Date: Wed, 30 Sep 2009 23:12:49 +0000
Subject: [PATCH] Fixed a buffer overflow when saving a game with too many
 devices

git-svn-id: svn://svn.code.sf.net/p/sc2/code/trunk@3182 8092fc87-c524-0410-9efc-e669fe64eaf9
---
 sc2/ChangeLog                     | 2 ++
 sc2/src/sc2code/planets/devices.c | 7 ++++---
 sc2/src/sc2code/save.c            | 3 ++-
 sc2/src/sc2code/shipcont.h        | 2 +-
 sc2/src/sc2code/sis.h             | 5 +++++
 5 files changed, 14 insertions(+), 5 deletions(-)

diff --git a/sc2/ChangeLog b/sc2/ChangeLog
index bf720ca0f..0f140c2d6 100644
--- a/sc2/ChangeLog
+++ b/sc2/ChangeLog
@@ -1,4 +1,6 @@
 Changes towards version 0.7:
+- Fixed crash when saving a game into the last slot while having
+  too many devices on board - Alex
 - Allow any sound data format to be graphed by comm oscilloscope; also
   auto-adjust the scope for different gain levels (bug #1064) - Alex
 - Game settings Quit menu now delegates to F10 quit (bug #462) - Alex
diff --git a/sc2/src/sc2code/planets/devices.c b/sc2/src/sc2code/planets/devices.c
index 8a826ad4e..eee21914f 100644
--- a/sc2/src/sc2code/planets/devices.c
+++ b/sc2/src/sc2code/planets/devices.c
@@ -532,13 +532,13 @@ SelectDevice:
 }
 
 SIZE
-InventoryDevices (BYTE *pDeviceMap)
+InventoryDevices (BYTE *pDeviceMap, COUNT Size)
 {
 	BYTE i;
 	SIZE DevicesOnBoard;
 	
 	DevicesOnBoard = 0;
-	for (i = 0; i < NUM_DEVICES; ++i)
+	for (i = 0; i < NUM_DEVICES && Size > 0; ++i)
 	{
 		BYTE DeviceState;
 
@@ -630,6 +630,7 @@ InventoryDevices (BYTE *pDeviceMap)
 		{
 			*pDeviceMap++ = i;
 			++DevicesOnBoard;
+			--Size;
 		}
 	}
 	
@@ -641,7 +642,7 @@ Devices (MENU_STATE *pMS)
 {
 	BYTE DeviceMap[NUM_DEVICES];
 
-	pMS->first_item.x = InventoryDevices (DeviceMap);
+	pMS->first_item.x = InventoryDevices (DeviceMap, NUM_DEVICES);
 	if (pMS->first_item.x)
 	{
 		pMS->InputFunc = DoManipulateDevices;
diff --git a/sc2/src/sc2code/save.c b/sc2/src/sc2code/save.c
index c6db424a7..f7d91df62 100644
--- a/sc2/src/sc2code/save.c
+++ b/sc2/src/sc2code/save.c
@@ -499,7 +499,8 @@ PrepareSummary (SUMMARY_DESC *SummPtr)
 		}
 	}
 
-	SummPtr->NumDevices = InventoryDevices (SummPtr->DeviceList);
+	SummPtr->NumDevices = InventoryDevices (SummPtr->DeviceList,
+			MAX_EXCLUSIVE_DEVICES);
 
 	SummPtr->Flags = GET_GAME_STATE (LANDER_SHIELDS)
 			| (GET_GAME_STATE (IMPROVED_LANDER_SPEED) << (4 + 0))
diff --git a/sc2/src/sc2code/shipcont.h b/sc2/src/sc2code/shipcont.h
index e28283e53..2c14bb0d5 100644
--- a/sc2/src/sc2code/shipcont.h
+++ b/sc2/src/sc2code/shipcont.h
@@ -30,7 +30,7 @@ extern BOOLEAN Devices (MENU_STATE *pMS);
 extern void DrawCargoStrings (BYTE OldElement, BYTE NewElement);
 extern void ShowRemainingCapacity (void);
 
-extern SIZE InventoryDevices (BYTE *pDeviceMap);
+extern SIZE InventoryDevices (BYTE *pDeviceMap, COUNT Size);
 
 #endif /* _SHIPCONT_H */
 
diff --git a/sc2/src/sc2code/sis.h b/sc2/src/sc2code/sis.h
index 49f767f0f..36e9f80ae 100644
--- a/sc2/src/sc2code/sis.h
+++ b/sc2/src/sc2code/sis.h
@@ -223,6 +223,11 @@ typedef struct
 	UNICODE PlanetName[SIS_NAME_SIZE];
 } SIS_STATE;
 
+// XXX: Theoretically, a player can have 17 devices on board without
+//   cheating (18 if never visited the Starbase). We only provide
+//   room for 16 below, which is not really a problem since this
+//   is only used for displaying savegame summaries. There is also
+//   room for only 16 devices on screen.
 #define MAX_EXCLUSIVE_DEVICES 16
 
 typedef struct