Skip to content

Multiple issues with sub_6FC6A8C0 #194

@Necrolis

Description

@Necrolis

sub_6FC6A8C0 (the function that spawns offset minions for tentacles) contains multiple issues.

  1. D2CoordStrc stru_6FD28B68[12] =

    This array should be static constexpr or at least static const.

  2. const int32_t nIndex = 2 * (nParam1 + nParam2);

    The calculated index is incorrect and will lead to OOB reads ((5 + 6) * 2 == 22). the original code does not multiply by 2, it simply adds the two values and then indexes (which is a multiply by 8 (sizeof(D2PositionStrc)) in the assembly).

  3. D2UnkMonCreateStrc monCreate = {};

    The initialization of monCreate not only has a redundant default initializer, but should also be hoisted out the loop, only the x & y positions change.

  4. if (a6 < 0 || a6 > 2)

    This line contains a vanilla bug: if a6 == 2 then we have OOB reads (and stru_6FD28B68 is indeed only 12 elements as its followed directly by the ancients monequip array in 1.13). a6 should be bounded to [0, 1] (it can also be renamed to bNonWaterSpawn since the only call site for this function passes in a value by checking the water spawning monster creation flag and then inverts it, aka !(Flags & 4); though it was likely done as an integral value so the raised code is closer to (~(flags >> 2)) & 1.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions