diff options
| author | Fabio Alessandrelli <fabio.alessandrelli@gmail.com> | 2021-08-02 13:34:06 +0200 |
|---|---|---|
| committer | Fabio Alessandrelli <fabio.alessandrelli@gmail.com> | 2021-08-02 13:35:33 +0200 |
| commit | fed0bf013abf4537a50084cce4405d4686d97d67 (patch) | |
| tree | c3df19d2206cf91de5682f22dd56cbb189df1362 /core/io | |
| parent | 33fd41472c7fb54280144fe46326cd6ffe9fc8af (diff) | |
[Marshalls] Fix Float64Array and Int64Array serialization.
One was incorrectly reading the size (potentially causing out-of-buffer
read), the other also potentially causing out-of-buffer write during
encoding.
Diffstat (limited to 'core/io')
| -rw-r--r-- | core/io/marshalls.cpp | 7 |
1 files changed, 3 insertions, 4 deletions
diff --git a/core/io/marshalls.cpp b/core/io/marshalls.cpp index 4f85eced93..e7d5b78d14 100644 --- a/core/io/marshalls.cpp +++ b/core/io/marshalls.cpp @@ -746,7 +746,7 @@ Error decode_variant(Variant &r_variant, const uint8_t *p_buffer, int p_len, int } break; case Variant::PACKED_INT64_ARRAY: { ERR_FAIL_COND_V(len < 4, ERR_INVALID_DATA); - int64_t count = decode_uint64(buf); + int32_t count = decode_uint32(buf); buf += 4; len -= 4; ERR_FAIL_MUL_OF(count, 8, ERR_INVALID_DATA); @@ -795,7 +795,7 @@ Error decode_variant(Variant &r_variant, const uint8_t *p_buffer, int p_len, int } break; case Variant::PACKED_FLOAT64_ARRAY: { ERR_FAIL_COND_V(len < 4, ERR_INVALID_DATA); - int64_t count = decode_uint64(buf); + int32_t count = decode_uint32(buf); buf += 4; len -= 4; ERR_FAIL_MUL_OF(count, 8, ERR_INVALID_DATA); @@ -804,7 +804,6 @@ Error decode_variant(Variant &r_variant, const uint8_t *p_buffer, int p_len, int Vector<double> data; if (count) { - //const double*rbuf=(const double*)buf; data.resize(count); double *w = data.ptrw(); for (int64_t i = 0; i < count; i++) { @@ -1519,7 +1518,7 @@ Error encode_variant(const Variant &p_variant, uint8_t *r_buffer, int &r_len, bo int datasize = sizeof(int64_t); if (buf) { - encode_uint64(datalen, buf); + encode_uint32(datalen, buf); buf += 4; const int64_t *r = data.ptr(); for (int64_t i = 0; i < datalen; i++) { |