diff options
| author |  Linus Torvalds <torvalds@linux-foundation.org> | 2019-07-14 10:40:04 -0700 |
|---|---|---|
| committer |  bstoeger <32835590+bstoeger@users.noreply.github.com> | 2019-07-14 22:17:13 +0200 |
| commit | c685c05ff413867114e6029ea182732d40fe1a64 (patch) | |
| tree | 6054e2adba2a10a6a6b7a3b43fca269ea6b45fa9 /core/save-xml.c | |
| parent | 3f2a73db7f747a0aff9a66c9589c355a61d64216 (diff) | |
| download | subsurface-c685c05ff413867114e6029ea182732d40fe1a64.tar.gz | |
Fix cylinder gas type saving when we have bogus gas use data
Steve Williams reported a crash when saving a previously loaded dive as
xml, and gave a gdb backtrace.
It turns out that if we can't parse the cylinder use type (OC, diluent,
oxygen, unused) we initialize the cylinder use to an invalid type, and
then when we save it, we mess up.
Fix it up by doing proper limit checking before accessing the
"cylinderuse_text[]" array when saving.
Reported-by: Steve <stevewilliams@internode.on.net>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'core/save-xml.c')
| -rw-r--r-- | core/save-xml.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/core/save-xml.c b/core/save-xml.c index 0af114ba0..da7b4738b 100644 --- a/core/save-xml.c +++ b/core/save-xml.c @@ -180,6 +180,7 @@ static void save_cylinder_info(struct membuffer *b, struct dive *dive) cylinder_t *cylinder = dive->cylinder + i; int volume = cylinder->type.size.mliter; const char *description = cylinder->type.description; + int use = cylinder->cylinder_use; put_format(b, " <cylinder"); if (volume) @@ -189,8 +190,8 @@ static void save_cylinder_info(struct membuffer *b, struct dive *dive) put_gasmix(b, cylinder->gasmix); put_pressure(b, cylinder->start, " start='", " bar'"); put_pressure(b, cylinder->end, " end='", " bar'"); - if (cylinder->cylinder_use != OC_GAS) - show_utf8(b, cylinderuse_text[cylinder->cylinder_use], " use='", "'", 1); + if (use > OC_GAS && use < NUM_GAS_USE) + show_utf8(b, cylinderuse_text[use], " use='", "'", 1); if (cylinder->depth.mm != 0) put_milli(b, " depth='", cylinder->depth.mm, " m'"); put_format(b, " />\n"); |