ChaosMarc/PlugY

Heap corruption when renaming stash

Closed this issue · 0 comments

Heap corruption caused by strcpy writing past the end of allocated memory ('\0' character).

stash->name = (char *)malloc(len);//D2FogMemAlloc(len,__FILE__,__LINE__,0);
strcpy(stash->name, name);

if (strlen((char *)&data[curSize]))
ptStash->name = (char*)malloc(strlen((char *)&data[curSize]));//D2AllocMem(PCGame->memoryPool, strlen((char *)&data[curSize]),__FILE__,__LINE__,0);
if (ptStash->name)
strcpy(ptStash->name, (char *)&data[curSize]);

Untitled