From 86d3173c18fc65b85f5107ead172608c201394f0 Mon Sep 17 00:00:00 2001 From: Noble_Fish <1065703286@qq.com> Date: Thu, 8 Oct 2026 05:37:39 +0800 Subject: [PATCH 1/2] fix negative-index OOB write in `CMapData::UpdateWaypoints` --- FA2sp/Algorithms/lcw_d.cpp | 30 +++++++++++++++++++----------- FA2sp/Ext/CMapData/Hooks.cpp | 2 +- 2 files changed, 20 insertions(+), 12 deletions(-) diff --git a/FA2sp/Algorithms/lcw_d.cpp b/FA2sp/Algorithms/lcw_d.cpp index 55fc393c..24ba052d 100644 --- a/FA2sp/Algorithms/lcw_d.cpp +++ b/FA2sp/Algorithms/lcw_d.cpp @@ -87,21 +87,29 @@ unsigned int __cdecl lcw::LCW_Uncompress(void* source, void* dest, unsigned int) source_ptr += 3; copy_ptr = dest_ptr + 4 - ((unsigned)dest_ptr & 0x3); - count -= (copy_ptr - dest_ptr); - while (dest_ptr < copy_ptr) *dest_ptr++ = data; + if (count < (unsigned)(copy_ptr - dest_ptr)) { + while (count--) *dest_ptr++ = data; + } + else { - word_dest_ptr = (unsigned*)dest_ptr; + count -= (copy_ptr - dest_ptr); - dest_ptr += (count & 0xfffffffc); + while (dest_ptr < copy_ptr) *dest_ptr++ = data; - while (word_dest_ptr < (unsigned*)dest_ptr) { - *word_dest_ptr = word_data; - *(word_dest_ptr + 1) = word_data; - word_dest_ptr += 2; - } + word_dest_ptr = (unsigned*)dest_ptr; + + dest_ptr += (count & 0xfffffffc); - copy_ptr = dest_ptr + (count & 0x3); - while (dest_ptr < copy_ptr) *dest_ptr++ = data; + while (word_dest_ptr < (unsigned*)dest_ptr) { + *word_dest_ptr = word_data; + *(word_dest_ptr + 1) = word_data; + word_dest_ptr += 2; + } + + copy_ptr = dest_ptr + (count & 0x3); + while (dest_ptr < copy_ptr) *dest_ptr++ = data; + + } } else { diff --git a/FA2sp/Ext/CMapData/Hooks.cpp b/FA2sp/Ext/CMapData/Hooks.cpp index b42ec1c9..adfef92d 100644 --- a/FA2sp/Ext/CMapData/Hooks.cpp +++ b/FA2sp/Ext/CMapData/Hooks.cpp @@ -1275,7 +1275,7 @@ DEFINE_HOOK(4A67D0, CMapData_UpdateWaypoints, 6) int x = atoi(data.second) / 1000; int y = atoi(data.second) % 1000; int pos = pThis->GetCoordIndex(x, y); - if (pos < pThis->CellDataCount) + if (pos >= 0 && pos < pThis->CellDataCount) pThis->CellDatas[pos].Waypoint = i; if (pThis->IsMultiOnly()) From bf432f7d3635de1c32248e4d0e3e69ec32cb9c27 Mon Sep 17 00:00:00 2001 From: Noble_Fish <1065703286@qq.com> Date: Thu, 8 Oct 2026 05:44:54 +0800 Subject: [PATCH 2/2] Remove the attached patches for other issues --- FA2sp/Algorithms/lcw_d.cpp | 30 +++++++++++------------------- 1 file changed, 11 insertions(+), 19 deletions(-) diff --git a/FA2sp/Algorithms/lcw_d.cpp b/FA2sp/Algorithms/lcw_d.cpp index 24ba052d..55fc393c 100644 --- a/FA2sp/Algorithms/lcw_d.cpp +++ b/FA2sp/Algorithms/lcw_d.cpp @@ -87,30 +87,22 @@ unsigned int __cdecl lcw::LCW_Uncompress(void* source, void* dest, unsigned int) source_ptr += 3; copy_ptr = dest_ptr + 4 - ((unsigned)dest_ptr & 0x3); - if (count < (unsigned)(copy_ptr - dest_ptr)) { - while (count--) *dest_ptr++ = data; - } - else { - - count -= (copy_ptr - dest_ptr); - - while (dest_ptr < copy_ptr) *dest_ptr++ = data; + count -= (copy_ptr - dest_ptr); + while (dest_ptr < copy_ptr) *dest_ptr++ = data; - word_dest_ptr = (unsigned*)dest_ptr; + word_dest_ptr = (unsigned*)dest_ptr; - dest_ptr += (count & 0xfffffffc); - - while (word_dest_ptr < (unsigned*)dest_ptr) { - *word_dest_ptr = word_data; - *(word_dest_ptr + 1) = word_data; - word_dest_ptr += 2; - } - - copy_ptr = dest_ptr + (count & 0x3); - while (dest_ptr < copy_ptr) *dest_ptr++ = data; + dest_ptr += (count & 0xfffffffc); + while (word_dest_ptr < (unsigned*)dest_ptr) { + *word_dest_ptr = word_data; + *(word_dest_ptr + 1) = word_data; + word_dest_ptr += 2; } + copy_ptr = dest_ptr + (count & 0x3); + while (dest_ptr < copy_ptr) *dest_ptr++ = data; + } else {