len0rd/rockbox
1
0
Fork 1
mirror of https://github.com/Rockbox/rockbox.git synced 2025-11-12 14:42:31 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix for Chessbox bug FS#10363

Browse source 
Chessbox was overflowing GameList[240] causing the board to flip + crash

GameCnt changed to unsigned char which allows the array to roll over
to 0 after 255

define MAX_GAME_CNT 256 and GameList[MAX_GAME_CNT] along with 1 byte GameCnt
should fix this issue

dbg save routine left in for now to help identify any other problems

Added bounds checking to prevent second bug found when loading .pgn files

Change-Id: I2b615c8ecbed4368724412f80ce07346f3cf30a7
This commit is contained in:
William Wilgus 2017-01-31 04:28:02 +01:00
parent 37522ec63a
commit 1fa7c56351
4 changed files with 164 additions and 34 deletions
Download patch file Download diff file Expand all files Collapse all files

9
apps/plugins/chessbox/gnuchess.c
View file

@ -103,8 +103,9 @@ short INCscore;
short HasPawn[2],HasKnight[2],HasBishop[2],HasRook[2],HasQueen[2];
short ChkFlag[maxdepth],CptrFlag[maxdepth],PawnThreat[maxdepth];
short Pscore[maxdepth],Tscore[maxdepth],Threat[maxdepth];
struct GameRec GameList[240];
short GameCnt,Game50,epsquare,lpost,rcptr,contempt;
struct GameRec GameList[MAX_GAME_CNT];
unsigned char GameCnt; /*Bug fix now rolls over instead of overflow*/
short Game50,epsquare,lpost,rcptr,contempt;
short MaxSearchDepth,Xscore;
struct TimeControlRec TimeControl;
short TCflag,TCmoves,TCminutes,OperatorTime;
@ -1132,7 +1133,7 @@ static short i,alpha,beta,score,tempb,tempc,tempsf,tempst,xside,rpt;
if (--TimeControl.moves[side] == 0) SetTimeControl();
}
if ((root->flags & draw) && bothsides) quit = true;
if (GameCnt > 238) quit = true;
if (GameCnt > MAX_GAME_CNT - 2) quit = true;
player = xside;
Sdepth = 0;
return(0);
@ -2319,7 +2320,7 @@ void NewGame() {
xwndw = 90;
MaxSearchDepth = 29;
contempt = 0;
GameCnt = -1; Game50 = 0;
GameCnt = MAX_GAME_CNT - 1; Game50 = 0;
Zwmtl = Zbmtl = 0;
Developed[white] = Developed[black] = false;
castld[white] = castld[black] = false;