Equim-chan/Mortal

Potential overflow

A0nameless0man opened this issue · 1 comments

This line reserves 4 ArrayVec with capacity of 24 to record kawa.

pub(super) kawa: [ArrayVec<[Option<KawaItem>; 24]>; 4],

Which isn't adequate because this lines can push at most 8 None into it .

pub(super) fn pad_kawa_for_pon_or_daiminkan(&mut self, abs_actor: u8, abs_target: u8) {
let mut i = (abs_target + 1) % 4;
while i != abs_actor {
let rel = self.rel(i);
self.kawa[rel].push(None);
i = (i + 1) % 4;
}
}

In my test , program sometimes crash at this line.

self.kawa[actor_rel].push(Some(KawaItem {

This has been fixed in v2 but not yet ported to v1 (this repo). The fix simply goes by changing ArrayVec to TinyVec.