Skip to content

Commit 035ff3e

Browse files
chief1983claude
andauthored
Fix standalone web UI crash when polling player data before ship selection (scp-fs2open#7367)
playerGet() indexed Ship_info with ship_class without bounds checking. Before ship selection, ship_class is -1, which as an unsigned index causes an out-of-bounds access. Add bounds check using ship_info_size(), matching the pattern used elsewhere in the codebase. Also update the Windows standalone GUI to use ship_info_size() for consistency. Fixes scp-fs2open#7366 Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
1 parent 1dd8f76 commit 035ff3e

2 files changed

Lines changed: 6 additions & 2 deletions

File tree

code/network/stand_gui-unix.cpp

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -457,7 +457,11 @@ json_t* playerGet(ResourceContext * /*context*/) {
457457
json_object_set(obj, "host", (MULTI_HOST(p)) ? json_true() : json_false());
458458
json_object_set(obj, "observer", (MULTI_OBSERVER(p)) ? json_true() : json_false());
459459
json_object_set(obj, "callsign", json_string(p.m_player->callsign));
460-
json_object_set(obj, "ship", json_string(Ship_info[p.p_info.ship_class].name));
460+
if (p.p_info.ship_class >= 0 && p.p_info.ship_class < ship_info_size()) {
461+
json_object_set(obj, "ship", json_string(Ship_info[p.p_info.ship_class].name));
462+
} else {
463+
json_object_set(obj, "ship", json_string(""));
464+
}
461465

462466
json_array_append(playerList, obj);
463467
}

code/network/stand_gui.cpp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1067,7 +1067,7 @@ void std_pinfo_display_player_info(net_player *p)
10671067
txt[sizeof(txt)-1] = '\0';
10681068

10691069
// set his ship type -- Cyborg17, if it's valid!
1070-
if (p->p_info.ship_class >= 0 && p->p_info.ship_class < static_cast<int>(Ship_info.size())) {
1070+
if (p->p_info.ship_class >= 0 && p->p_info.ship_class < ship_info_size()) {
10711071
SetWindowText(Player_ship_type, Ship_info[p->p_info.ship_class].name);
10721072
}
10731073

0 commit comments

Comments
 (0)