JACoders/OpenJK

Rend2 out-of-bounds write while outside the map in the negative direction.

Charlese2 opened this issue · 1 comments

Reporting a bug? Please make sure you've given the following information - thanks!

Operating system and version:
Windows 11 Version 22H2 (OS build 22621.2428)

Is this for single player or multiplayer?
Multiplayer

Description of the bug (and if possible, steps to reproduce the bug):
The Remainder of a negative Dividend with a positive Divisor can be a negative number. For example this modulo -1 % 3 would result in -1. If centerZoneOffsetX (or Y) is a low enough number by noclipping outside the map while going in a negative direction, it will make the Dividend negative.

chunkIndex = (int(centerZoneOffsetX + numMinZonesX) + x + 1) % 3;
chunkIndex += (int(centerZoneOffsetY + numMinZonesY) + y + 1) % 3 * 3;
VectorSet2(
zoneOffsets[chunkIndex],
x,
y);

If chunkIndex ends up as a negative number it writes outside of the zoneOffsets buffer.
vec2_t zoneOffsets[9];

What did you expect to happen instead?
I expected it to not crash from stack corruption from noclipping outside the map. I know it is a obscure use case.

I was able to replicate this on vjun1.
Will fix and open up a PR.