Skip to content

fix: the path buffer allocation at env in env.h#571

Open
orbisai0security wants to merge 1 commit into
PufferAI:4.0from
orbisai0security:fix-v-002-integer-overflow-path-buffer
Open

fix: the path buffer allocation at env in env.h#571
orbisai0security wants to merge 1 commit into
PufferAI:4.0from
orbisai0security:fix-v-002-integer-overflow-path-buffer

Conversation

@orbisai0security
Copy link
Copy Markdown

Summary

Fix high severity security issue in ocean/impulse_wars/env.h.

Vulnerability

Field Value
ID V-002
Severity HIGH
Scanner multi_agent_ai
Rule V-002
File ocean/impulse_wars/env.h:590
CWE CWE-120

Description: The path buffer allocation at env.h:590 computes its size as map->rows * map->columns * map->rows * map->columns * sizeof(uint8_t). When map dimensions are stored in 32-bit integers, this four-way multiplication overflows for moderate map sizes (e.g., rows=256, columns=256 produces 4,294,967,296, which wraps to 0 in a 32-bit unsigned context). fastMalloc then allocates a zero-byte or tiny buffer, and subsequent path-finding writes far beyond it, causing a heap buffer overflow.

Changes

  • ocean/impulse_wars/env.h

Verification

  • Build passes
  • Scanner re-scan confirms fix
  • LLM code review passed

Automated security fix by OrbisAI Security

Automated security fix generated by OrbisAI Security
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant