Skip to content

(Potential buffer over-read) Ensure the string g_player[i].wchoice is properly formatted.

This was originally reproduced as a crash in NetDuke32, but may potentially be a problem in EDuke32 as well.

I don't know the exact cause of having wchoice set as described here - could be a random cfg corruption of a known kind - but I had wchoice set to the string "secwd22221" for NetDuke32. EDuke32 also allows this, including a change from the console.

Within P_CheckWeapon, this can lead to a buffer over-read (or at least, integer shift count overflow). It's possible this was manifested as a crash in NetDuke32 due to the gotweapon field still being an array, but even with EDuke32's form, this might be a problem.

Edited by NY00123