-
Notifications
You must be signed in to change notification settings - Fork 7
Open
Description
What steps will reproduce the problem?
1. build ghost++
2. setup ghost++
3. run ghost++
What is the expected output? What do you see instead?
-
What version of the product are you using? On what operating system?
the latest revision from trunk on 01-03-2013
Watch CBNCSUtilInterface :: HELP_SID_AUTH_CHECK function in
bncsutilinterface.cpp:
uint32_t EXEVersionHash;
checkRevisionFlat( ..., (unsigned long*)&EXEVersionHash );
We CAN NOT pass a pointer to the 32-bit value as a 64-bit value pointer. Even
if we know that value is less than 0xFFFFFFFF
This will cause a stack corruption under x86-64 little-endian platform.
Why it works under x86-64 big endian:
Low 32 bits under BE are stored in in the first 4 bytes of 8-byte unsigned long value.
But under LE it causes a stack corruption because a local variable
EXEVersionHash (it is stored on the stack) is only 4-byte size, so
checkRevisionFlat tries to put the result in (&EXEVersionHash + 4).
How to fix:
unsigned long EXEVersionHash;
checkRevisionFlat( valueStringFormula.c_str( ), FileWar3EXE.c_str( ),
FileStormDLL.c_str( ), FileGameDLL.c_str( ), extractMPQNumber(
mpqFileName.c_str( ) ), &EXEVersionHash );
// A compiler will automatically cast 64-bit value to the 32-bit one
considering LE/BE byte order.
uint32_t EXEVersionHash32 = (uint32_t)EXEVersionHash;
m_EXEVersionHash = UTIL_CreateByteArray( EXEVersionHash32, false );
Original issue reported on code.google.com by FukOfHea...@gmail.com on 1 Mar 2013 at 1:16