-
Notifications
You must be signed in to change notification settings - Fork 34
Open
Description
sub_6FC6A8C0 (the function that spawns offset minions for tentacles) contains multiple issues.
-
D2MOO/source/D2Game/src/MONSTER/MonsterSpawn.cpp
Line 1484 in 8322494
D2CoordStrc stru_6FD28B68[12] =
This array should bestatic constexpror at leaststatic const. -
D2MOO/source/D2Game/src/MONSTER/MonsterSpawn.cpp
Line 1521 in 8322494
const int32_t nIndex = 2 * (nParam1 + nParam2);
The calculated index is incorrect and will lead to OOB reads ((5 + 6) * 2 == 22). the original code does not multiply by 2, it simply adds the two values and then indexes (which is a multiply by 8 (sizeof(D2PositionStrc)) in the assembly). -
D2MOO/source/D2Game/src/MONSTER/MonsterSpawn.cpp
Line 1523 in 8322494
D2UnkMonCreateStrc monCreate = {};
The initialization ofmonCreatenot only has a redundant default initializer, but should also be hoisted out the loop, only the x & y positions change. -
D2MOO/source/D2Game/src/MONSTER/MonsterSpawn.cpp
Line 1506 in 8322494
if (a6 < 0 || a6 > 2)
This line contains a vanilla bug: ifa6 == 2then we have OOB reads (andstru_6FD28B68is indeed only 12 elements as its followed directly by the ancients monequip array in 1.13).a6should be bounded to [0, 1] (it can also be renamed tobNonWaterSpawnsince the only call site for this function passes in a value by checking the water spawning monster creation flag and then inverts it, aka!(Flags & 4); though it was likely done as an integral value so the raised code is closer to(~(flags >> 2)) & 1.
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
No labels