1 files changed, 44 insertions, 0 deletions

diff --git a/linden/indra/lscript/lscript_byteconvert.h b/linden/indra/lscript/lscript_byteconvert.h
index 06d494e..6d0e2d0 100644
--- a/linden/indra/lscript/lscript_byteconvert.h
+++ b/linden/indra/lscript/lscript_byteconvert.h
@@ -2,6 +2,8 @@
  * @file lscript_byteconvert.h
  * @brief Shared code for compiler and assembler for LSL
  *
+ * $LicenseInfo:firstyear=2002&license=viewergpl$
+ * 
  * Copyright (c) 2002-2007, Linden Research, Inc.
  * 
  * Second Life Viewer Source Code
@@ -24,6 +26,7 @@
  * ALL LINDEN LAB SOURCE CODE IS PROVIDED "AS IS." LINDEN LAB MAKES NO
  * WARRANTIES, EXPRESS, IMPLIED OR OTHERWISE, REGARDING ITS ACCURACY,
  * COMPLETENESS OR PERFORMANCE.
+ * $/LicenseInfo$
  */
 
 // data shared between compiler/assembler
@@ -781,9 +784,17 @@ inline S32 get_state_event_opcoode_start(U8 *stream, S32 state, LSCRIPTStateEven
                 major_version = LSL2_MAJOR_VERSION_TWO;
                 state_offset_offset = sr + LSCRIPTDataSize[LST_INTEGER] + LSCRIPTDataSize[LST_INTEGER]*3*state;
         }
+        if ( state_offset_offset < 0 || state_offset_offset > TOP_OF_MEMORY )
+        {
+                return -1;
+        }
 
         // get the actual position in memory of the desired state
         S32 state_offset = sr + bytestream2integer(stream, state_offset_offset);
+        if ( state_offset < 0 || state_offset > TOP_OF_MEMORY )
+        {
+                return -1;
+        }
 
         // save that value
         S32 state_offset_base = state_offset;
@@ -793,18 +804,32 @@ inline S32 get_state_event_opcoode_start(U8 *stream, S32 state, LSCRIPTStateEven
 
         // get the location of the event offset
         S32 event_offset = event_jump_offset + LSCRIPTDataSize[LST_INTEGER]*2*get_event_handler_jump_position(get_event_register(stream, LREG_ER, major_version), event);
+        if ( event_offset < 0 || event_offset > TOP_OF_MEMORY )
+        {
+                return -1;
+        }
 
         // now, jump to the event
         S32 event_start = bytestream2integer(stream, event_offset);
+        if ( event_start < 0 || event_start > TOP_OF_MEMORY )
+        {
+                return -1;
+        }
         event_start += event_jump_offset;
 
         S32 event_start_original = event_start;
 
         // now skip past the parameters
         S32 opcode_offset = bytestream2integer(stream, event_start);
+        if ( opcode_offset < 0 || opcode_offset > TOP_OF_MEMORY )
+        {
+                return -1;
+        }
+
         return opcode_offset + event_start_original;
 }
 
+
 inline U64 get_handled_events(U8 *stream, S32 state)
 {
         U64 retvalue = 0;
@@ -829,6 +854,7 @@ inline U64 get_handled_events(U8 *stream, S32 state)
         return retvalue;
 }
 
+// Returns -1 on error
 inline S32 get_event_stack_size(U8 *stream, S32 state, LSCRIPTStateEventType event)
 {
         // get the start of the state table
@@ -849,21 +875,39 @@ inline S32 get_event_stack_size(U8 *stream, S32 state, LSCRIPTStateEventType eve
                 state_offset_offset = sr + LSCRIPTDataSize[LST_INTEGER] + LSCRIPTDataSize[LST_INTEGER]*3*state;
         }
 
+        if ( state_offset_offset < 0 || state_offset_offset > TOP_OF_MEMORY )
+        {
+                return -1;
+        }
+
         S32 state_offset = bytestream2integer(stream, state_offset_offset);
         state_offset += sr;
 
         state_offset_offset = state_offset;
+        if ( state_offset_offset < 0 || state_offset_offset > TOP_OF_MEMORY )
+        {
+                return -1;
+        }
 
         // skip to jump table
         S32 jump_table = bytestream2integer(stream, state_offset_offset);
 
         jump_table += state_offset;
+        if ( jump_table < 0 || jump_table > TOP_OF_MEMORY )
+        {
+                return -1;
+        }
 
         // get the position of the jump to the desired state
         S32 stack_size_offset = jump_table + LSCRIPTDataSize[LST_INTEGER]*2*get_event_handler_jump_position(get_event_register(stream, LREG_ER, major_version), event) + LSCRIPTDataSize[LST_INTEGER];
 
         // get the handled events
         S32 stack_size = bytestream2integer(stream, stack_size_offset);
+        if ( stack_size < 0 || stack_size > TOP_OF_MEMORY )
+        {
+                return -1;
+        }
+
         return stack_size;
 }