diff options
author | William Wilgus <me.theuser@yahoo.com> | 2017-01-31 04:28:02 +0100 |
---|---|---|
committer | William Wilgus <me.theuser@yahoo.com> | 2017-02-01 01:33:48 +0100 |
commit | 1fa7c5635184e3a8c16b696a658c027fcc0862d8 (patch) | |
tree | debeb03ca2da9a20ccfae5ece4fc512847046014 /apps/plugins/chessbox/gnuchess.c | |
parent | 37522ec63ae8fd2f88a66ed3d7020ebe95e9980e (diff) | |
download | rockbox-1fa7c5635184e3a8c16b696a658c027fcc0862d8.tar.gz rockbox-1fa7c5635184e3a8c16b696a658c027fcc0862d8.zip |
Fix for Chessbox bug FS#10363
Chessbox was overflowing GameList[240] causing the board to flip + crash
GameCnt changed to unsigned char which allows the array to roll over
to 0 after 255
define MAX_GAME_CNT 256 and GameList[MAX_GAME_CNT] along with 1 byte GameCnt
should fix this issue
dbg save routine left in for now to help identify any other problems
Added bounds checking to prevent second bug found when loading .pgn files
Change-Id: I2b615c8ecbed4368724412f80ce07346f3cf30a7
Diffstat (limited to 'apps/plugins/chessbox/gnuchess.c')
-rw-r--r-- | apps/plugins/chessbox/gnuchess.c | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/apps/plugins/chessbox/gnuchess.c b/apps/plugins/chessbox/gnuchess.c index 5e67df4f39..4b21cd785c 100644 --- a/apps/plugins/chessbox/gnuchess.c +++ b/apps/plugins/chessbox/gnuchess.c | |||
@@ -103,8 +103,9 @@ short INCscore; | |||
103 | short HasPawn[2],HasKnight[2],HasBishop[2],HasRook[2],HasQueen[2]; | 103 | short HasPawn[2],HasKnight[2],HasBishop[2],HasRook[2],HasQueen[2]; |
104 | short ChkFlag[maxdepth],CptrFlag[maxdepth],PawnThreat[maxdepth]; | 104 | short ChkFlag[maxdepth],CptrFlag[maxdepth],PawnThreat[maxdepth]; |
105 | short Pscore[maxdepth],Tscore[maxdepth],Threat[maxdepth]; | 105 | short Pscore[maxdepth],Tscore[maxdepth],Threat[maxdepth]; |
106 | struct GameRec GameList[240]; | 106 | struct GameRec GameList[MAX_GAME_CNT]; |
107 | short GameCnt,Game50,epsquare,lpost,rcptr,contempt; | 107 | unsigned char GameCnt; /*Bug fix now rolls over instead of overflow*/ |
108 | short Game50,epsquare,lpost,rcptr,contempt; | ||
108 | short MaxSearchDepth,Xscore; | 109 | short MaxSearchDepth,Xscore; |
109 | struct TimeControlRec TimeControl; | 110 | struct TimeControlRec TimeControl; |
110 | short TCflag,TCmoves,TCminutes,OperatorTime; | 111 | short TCflag,TCmoves,TCminutes,OperatorTime; |
@@ -1132,7 +1133,7 @@ static short i,alpha,beta,score,tempb,tempc,tempsf,tempst,xside,rpt; | |||
1132 | if (--TimeControl.moves[side] == 0) SetTimeControl(); | 1133 | if (--TimeControl.moves[side] == 0) SetTimeControl(); |
1133 | } | 1134 | } |
1134 | if ((root->flags & draw) && bothsides) quit = true; | 1135 | if ((root->flags & draw) && bothsides) quit = true; |
1135 | if (GameCnt > 238) quit = true; | 1136 | if (GameCnt > MAX_GAME_CNT - 2) quit = true; |
1136 | player = xside; | 1137 | player = xside; |
1137 | Sdepth = 0; | 1138 | Sdepth = 0; |
1138 | return(0); | 1139 | return(0); |
@@ -2319,7 +2320,7 @@ void NewGame() { | |||
2319 | xwndw = 90; | 2320 | xwndw = 90; |
2320 | MaxSearchDepth = 29; | 2321 | MaxSearchDepth = 29; |
2321 | contempt = 0; | 2322 | contempt = 0; |
2322 | GameCnt = -1; Game50 = 0; | 2323 | GameCnt = MAX_GAME_CNT - 1; Game50 = 0; |
2323 | Zwmtl = Zbmtl = 0; | 2324 | Zwmtl = Zbmtl = 0; |
2324 | Developed[white] = Developed[black] = false; | 2325 | Developed[white] = Developed[black] = false; |
2325 | castld[white] = castld[black] = false; | 2326 | castld[white] = castld[black] = false; |