From a6c5d8d8b031a0b7eda81ba4f513fdb8ae0fe467 Mon Sep 17 00:00:00 2001 From: Mauller <26652186+Mauller@users.noreply.github.com> Date: Sun, 20 Apr 2025 18:54:38 +0100 Subject: [PATCH] [GEN][ZH] Fix uninitialized memory read in DockUpdate::loadDockPositions() (#731) Co-authored-by: Helmut Buhler --- .../Source/GameLogic/Object/Update/DockUpdate/DockUpdate.cpp | 4 +++- .../Source/GameLogic/Object/Update/DockUpdate/DockUpdate.cpp | 4 +++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/Generals/Code/GameEngine/Source/GameLogic/Object/Update/DockUpdate/DockUpdate.cpp b/Generals/Code/GameEngine/Source/GameLogic/Object/Update/DockUpdate/DockUpdate.cpp index eb8fab038d6..1e9131b938a 100644 --- a/Generals/Code/GameEngine/Source/GameLogic/Object/Update/DockUpdate/DockUpdate.cpp +++ b/Generals/Code/GameEngine/Source/GameLogic/Object/Update/DockUpdate/DockUpdate.cpp @@ -501,7 +501,9 @@ void DockUpdate::loadDockPositions() if( m_numberApproachPositions != DYNAMIC_APPROACH_VECTOR_FLAG ) { // Dynamic means no bones - Coord3D approachBones[DEFAULT_APPROACH_VECTOR_SIZE]; + // TheSuperHackers @fix helmutbuhler 19/04/2025 Zero initialize array to prevent uninitialized memory reads. + // Important: the entire target vector is used for serialization and crc and must not contain random data. + Coord3D approachBones[DEFAULT_APPROACH_VECTOR_SIZE] = {0}; m_numberApproachPositionBones = myDrawable->getPristineBonePositions( "DockWaiting", 1, approachBones, NULL, m_numberApproachPositions); if( m_numberApproachPositions == m_approachPositions.size() )//safeguard: will always be true { diff --git a/GeneralsMD/Code/GameEngine/Source/GameLogic/Object/Update/DockUpdate/DockUpdate.cpp b/GeneralsMD/Code/GameEngine/Source/GameLogic/Object/Update/DockUpdate/DockUpdate.cpp index b3571f64639..75a770a2142 100644 --- a/GeneralsMD/Code/GameEngine/Source/GameLogic/Object/Update/DockUpdate/DockUpdate.cpp +++ b/GeneralsMD/Code/GameEngine/Source/GameLogic/Object/Update/DockUpdate/DockUpdate.cpp @@ -510,7 +510,9 @@ void DockUpdate::loadDockPositions() if( m_numberApproachPositions != DYNAMIC_APPROACH_VECTOR_FLAG ) { // Dynamic means no bones - Coord3D approachBones[DEFAULT_APPROACH_VECTOR_SIZE]; + // TheSuperHackers @fix helmutbuhler 19/04/2025 Zero initialize array to prevent uninitialized memory reads. + // Important: the entire target vector is used for serialization and crc and must not contain random data. + Coord3D approachBones[DEFAULT_APPROACH_VECTOR_SIZE] = {0}; m_numberApproachPositionBones = myDrawable->getPristineBonePositions( "DockWaiting", 1, approachBones, NULL, m_numberApproachPositions); if( m_numberApproachPositions == m_approachPositions.size() )//safeguard: will always be true {