P2: A 15-stage briefing reads past the voice array on the objectives slide
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 83/100
Research direction
The report identifies brief_render in missionbrief.cpp and brief_voice_play in missionbriefcommon.cpp; start by reading those call sites and how briefing stages and the objectives slide are indexed. Reproduce with a 15-stage briefing and briefing voice enabled, ideally under AddressSanitizer. Done when the objectives slide displays without an out-of-bounds read or invalid voice handle.
Written by the indexing model from the issue text.
Description
Problem
A briefing with the maximum 15 stages reads past the end of the briefing voice array when the player reaches the objectives slide. The objectives slide is shown as an extra stage after the last one, so its index is 15, but the voice handle array only has 15 entries (0 to 14). The value read from just past the array is then treated as a voice stream handle.
Steps to reproduce
- FSO master (tested on 12a36dc1a with an ASan debug build; the briefing files are unchanged on current master 76219fd1e), Linux, MediaVPs 5.0.2, briefing voice enabled (the default).
- A single-player mission whose briefing has 15 stages (
$num_stages: 15) and that shows the goals slide (normal missions do). - Start the mission and step through the briefing with the Right arrow to the objectives slide.
Expected vs. actual behavior
Expected: the objectives slide shows normally.
Actual: AddressSanitizer reports a global-buffer-overflow read in brief_voice_play (missionbriefcommon.cpp:2489), called from brief_render (missionbrief.cpp:1188), at 0 bytes after Brief_voices (60 bytes, 15 entries). In a normal build the out-of-range value may be used as a stream handle (from reading the code).
Proposed fixes
- Don't play a voice for the objectives slide. In
brief_render, only callbrief_voice_playwhen the current stage is a real briefing stage (less than the briefing's stage count). Small and local. - Bounds-check inside the voice functions. Have
brief_voice_playand its siblings return early for a stage index at or past the array size. - Size the array for the extra slide. Give the voice array one more slot than
MAX_BRIEF_STAGES, kept at -1 so the objectives slide simply has no voice.
- Dominant language
- C++
- Stars
- 488
- Forks
- 184
- Avg merge
- 2d 9h
- Merged PRs (30d)
- 40
Getting set up
We have not checked this project's setup files yet. Start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from scp-fs2open/fs2open.github.com
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
scp-fs2open/fs2open.github.com#7917 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
scp-fs2open/fs2open.github.com#7916 ·
Maintainers usually reply within 1 day
-
P2: A timed rotation maneuver does nothing on a ship that had an earlier timed lateral maneuverPossibly taken @vovosta claimed this 3 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
scp-fs2open/fs2open.github.com#7914 · 3 comments ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
scp-fs2open/fs2open.github.com#7901 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
scp-fs2open/fs2open.github.com#7899 ·
Maintainers usually reply within 1 day
All issues in scp-fs2open/fs2open.github.com
Similar issues
-
Eval bug: minimax-m3: build_moe_ffn() drops the per-expert NVFP4 scale → garbled output (M3.1 Flash)Openbug-unconfirmed
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
Status: Needs confirmation Status: Needs triage
Difficulty 1/5 Under an hour Newbie friendliness 70/100
Maintainers usually reply within 1 day
-
[BUG] Failed archive extraction deletes the dataset cachePossibly taken @dajiaohuang claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
alibaba/GraphScope#4674 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 93/100
webarkit/WebARKitLib#107 ·
Maintainers usually reply within 1 day