Skip to content

Commit 3a48613

Browse files
authored
Add some security to avoid invalid Random::next() calls. (#5988)
There were a few instances of `Random::next()` being called without ensuring its arguments couldn't trip an assertion. This should hopefully catch them all.
1 parent 9987581 commit 3a48613

File tree

3 files changed

+10
-4
lines changed

3 files changed

+10
-4
lines changed

code/asteroid/asteroid.cpp

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1049,6 +1049,7 @@ bool asteroid_is_within_view(vec3d *pos, float range, bool range_override)
10491049
*/
10501050
static void maybe_throw_asteroid()
10511051
{
1052+
Assertion(Asteroid_field.num_used_field_debris_types > 0, "maybe_throw_asteroid() called while num_used_field_debris_types was 0; this should never happen, get a coder!");
10521053

10531054
for (asteroid_target& target : Asteroid_targets) {
10541055
if (!timestamp_elapsed(target.throw_stamp))
@@ -2584,6 +2585,11 @@ void asteroid_frame()
25842585
return;
25852586
}
25862587

2588+
// If no asteroid types are defined for the field, abort.
2589+
if (Asteroid_field.num_used_field_debris_types <= 0) {
2590+
return;
2591+
}
2592+
25872593
// If there are no explicit targets, fall back to default retail targeting behavior
25882594
if (Asteroid_field.target_names.empty()) {
25892595
int objnum = set_asteroid_throw_objnum();

code/debris/debris.cpp

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -501,11 +501,11 @@ object *debris_create_only(int parent_objnum, int parent_ship_class, int alt_typ
501501
}
502502
else if (vaporize) {
503503
db->model_num = Debris_vaporize_model;
504-
db->submodel_num = Random::next(Debris_num_submodels);
504+
db->submodel_num = (Debris_num_submodels <= 0 ? 0 : Random::next(Debris_num_submodels));
505505
}
506506
else {
507507
db->model_num = Debris_model;
508-
db->submodel_num = Random::next(Debris_num_submodels);
508+
db->submodel_num = (Debris_num_submodels <= 0 ? 0 : Random::next(Debris_num_submodels));
509509
}
510510
}
511511
else {
@@ -644,7 +644,7 @@ object *debris_create_only(int parent_objnum, int parent_ship_class, int alt_typ
644644
if (spark_timeout >= 0) {
645645
db->fire_timeout = _timestamp(spark_timeout);
646646
} else if (parent_objnum >= 0) {
647-
float t = 1000*Objects[parent_objnum].radius/3 + Random::next(fl2i(1000*3*Objects[parent_objnum].radius));
647+
float t = 1000*Objects[parent_objnum].radius/3 + (fl2i(1000*3*Objects[parent_objnum].radius) == 0 ? 0 : Random::next(fl2i(1000*3*Objects[parent_objnum].radius)));
648648
db->fire_timeout = _timestamp(fl2i(t)); // fireballs last from 5 - 30 seconds
649649
} else {
650650
db->fire_timeout = TIMESTAMP::immediate();

code/hud/hudartillery.cpp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -327,7 +327,7 @@ void ssm_create(object *target, vec3d *start, size_t ssm_index, ssm_firing_info
327327
// Init the ssm data
328328

329329
count = Ssm_info[ssm_index].count;
330-
if (Ssm_info[ssm_index].max_count != -1) {
330+
if (Ssm_info[ssm_index].max_count != -1 && (Ssm_info[ssm_index].max_count - count) > 0) {
331331
count += Random::next(count, Ssm_info[ssm_index].max_count);
332332
}
333333

0 commit comments

Comments
 (0)