1 files changed, 73 insertions, 38 deletions

diff --git a/linden/indra/lscript/lscript_execute/lscript_execute.cpp b/linden/indra/lscript/lscript_execute/lscript_execute.cpp
index a81d706..b5d395e 100644
--- a/linden/indra/lscript/lscript_execute/lscript_execute.cpp
+++ b/linden/indra/lscript/lscript_execute/lscript_execute.cpp
@@ -39,7 +39,7 @@
 void (*binary_operations[LST_EOF][LST_EOF])(U8 *buffer, LSCRIPTOpCodesEnum opcode);
 void (*unary_operations[LST_EOF])(U8 *buffer, LSCRIPTOpCodesEnum opcode);
 
-char *LSCRIPTRunTimeFaultStrings[LSRF_EOF] =
+char* LSCRIPTRunTimeFaultStrings[LSRF_EOF] =            /*Flawfinder: ignore*/
 {
         "invalid",                              //      LSRF_INVALID,
         "Math Error",                   //      LSRF_MATH,
@@ -2596,6 +2596,7 @@ BOOL run_jump(U8 *buffer, S32 &offset, BOOL b_print, const LLUUID &id)
         offset += arg;
         return FALSE;
 }
+
 BOOL run_jumpif(U8 *buffer, S32 &offset, BOOL b_print, const LLUUID &id)
 {
         if (b_print)
@@ -2648,8 +2649,10 @@ BOOL run_jumpif(U8 *buffer, S32 &offset, BOOL b_print, const LLUUID &id)
         else if (type == LST_STRING)
         {
                 S32 base_address = lscript_pop_int(buffer);
-        // this bit of nastiness is to get around that code paths to local variables can result in lack of initialization
-        // and function clean up of ref counts isn't based on scope (a mistake, I know)
+                // this bit of nastiness is to get around that code paths to
+                // local variables can result in lack of initialization and
+                // function clean up of ref counts isn't based on scope (a
+                // mistake, I know)
                 S32 address = base_address + get_register(buffer, LREG_HR) - 1;
                 if (address)
                 {
@@ -2662,7 +2665,7 @@ BOOL run_jumpif(U8 *buffer, S32 &offset, BOOL b_print, const LLUUID &id)
                                 S32 size = toffset - string;
                                 char *sdata = new char[size];
                                 bytestream2char(sdata, buffer, string);
-                                if (strlen(sdata))
+                                if (strlen(sdata))              /*Flawfinder: ignore*/
                                 {
                                         offset += arg;
                                 }
@@ -2674,8 +2677,10 @@ BOOL run_jumpif(U8 *buffer, S32 &offset, BOOL b_print, const LLUUID &id)
         else if (type == LST_KEY)
         {
                 S32 base_address = lscript_pop_int(buffer);
-        // this bit of nastiness is to get around that code paths to local variables can result in lack of initialization
-        // and function clean up of ref counts isn't based on scope (a mistake, I know)
+                // this bit of nastiness is to get around that code paths to
+                // local variables can result in lack of initialization and
+                // function clean up of ref counts isn't based on scope (a
+                // mistake, I know)
                 S32 address = base_address + get_register(buffer, LREG_HR) - 1;
                 if (address)
                 {
@@ -2688,29 +2693,37 @@ BOOL run_jumpif(U8 *buffer, S32 &offset, BOOL b_print, const LLUUID &id)
                                 S32 size = toffset - string;
                                 char *sdata = new char[size];
                                 bytestream2char(sdata, buffer, string);
-                                if (strlen(sdata))
+                                if (strlen(sdata))              /*Flawfinder: ignore*/
                                 {
                                         LLUUID id;
-                                        id.set(sdata);
-                                        if (id != LLUUID::null)
+                                        if (id.set(sdata) && id.notNull())
                                                 offset += arg;
                                 }
                                 delete [] sdata;
                         }
                         lsa_decrease_ref_count(buffer, base_address);
                 }
-                else if (type == LST_LIST)
+        }
+        else if (type == LST_LIST)
+        {
+                S32 base_address = lscript_pop_int(buffer);
+                S32 address = base_address + get_register(buffer, LREG_HR) - 1;
+                if (address)
                 {
-                        S32 address = lscript_pop_int(buffer);
-                        LLScriptLibData *list = lsa_get_data(buffer, address, TRUE);
-                        if (list->getListLength())
+                        if (safe_heap_check_address(buffer, address + SIZEOF_SCRIPT_ALLOC_ENTRY, 1))
                         {
-                                offset += arg;
+                                LLScriptLibData *list = lsa_get_list_ptr(buffer, base_address, TRUE);
+                                if (list && list->getListLength())
+                                {
+                                        offset += arg;
+                                }
+                                delete list;
                         }
                 }
         }
         return FALSE;
 }
+
 BOOL run_jumpnif(U8 *buffer, S32 &offset, BOOL b_print, const LLUUID &id)
 {
         if (b_print)
@@ -2763,8 +2776,10 @@ BOOL run_jumpnif(U8 *buffer, S32 &offset, BOOL b_print, const LLUUID &id)
         else if (type == LST_STRING)
         {
                 S32 base_address = lscript_pop_int(buffer);
-        // this bit of nastiness is to get around that code paths to local variables can result in lack of initialization
-        // and function clean up of ref counts isn't based on scope (a mistake, I know)
+                // this bit of nastiness is to get around that code paths to
+                // local variables can result in lack of initialization and
+                // function clean up of ref counts isn't based on scope (a
+                // mistake, I know)
                 S32 address = base_address + get_register(buffer, LREG_HR) - 1;
                 if (address)
                 {
@@ -2777,7 +2792,7 @@ BOOL run_jumpnif(U8 *buffer, S32 &offset, BOOL b_print, const LLUUID &id)
                                 S32 size = toffset - string;
                                 char *sdata = new char[size];
                                 bytestream2char(sdata, buffer, string);
-                                if (!strlen(sdata))
+                                if (!strlen(sdata))             /*Flawfinder: ignore*/
                                 {
                                         offset += arg;
                                 }
@@ -2789,8 +2804,10 @@ BOOL run_jumpnif(U8 *buffer, S32 &offset, BOOL b_print, const LLUUID &id)
         else if (type == LST_KEY)
         {
                 S32 base_address = lscript_pop_int(buffer);
-        // this bit of nastiness is to get around that code paths to local variables can result in lack of initialization
-        // and function clean up of ref counts isn't based on scope (a mistake, I know)
+                // this bit of nastiness is to get around that code paths to
+                // local variables can result in lack of initialization and
+                // function clean up of ref counts isn't based on scope (a
+                // mistake, I know)
                 S32 address = base_address + get_register(buffer, LREG_HR) - 1;
                 if (address)
                 {
@@ -2803,11 +2820,10 @@ BOOL run_jumpnif(U8 *buffer, S32 &offset, BOOL b_print, const LLUUID &id)
                                 S32 size = toffset - string;
                                 char *sdata = new char[size];
                                 bytestream2char(sdata, buffer, string);
-                                if (strlen(sdata))
+                                if (strlen(sdata))              /*Flawfinder: ignore*/
                                 {
                                         LLUUID id;
-                                        id.set(sdata);
-                                        if (id == LLUUID::null)
+                                        if (!id.set(sdata) || id.isNull())
                                                 offset += arg;
                                 }
                                 else
@@ -2818,13 +2834,25 @@ BOOL run_jumpnif(U8 *buffer, S32 &offset, BOOL b_print, const LLUUID &id)
                         }
                         lsa_decrease_ref_count(buffer, base_address);
                 }
-                else if (type == LST_LIST)
+        }
+        else if (type == LST_LIST)
+        {
+                S32 base_address = lscript_pop_int(buffer);
+                // this bit of nastiness is to get around that code paths to
+                // local variables can result in lack of initialization and
+                // function clean up of ref counts isn't based on scope (a
+                // mistake, I know)
+                S32 address = base_address + get_register(buffer, LREG_HR) - 1;
+                if (address)
                 {
-                        S32 address = lscript_pop_int(buffer);
-                        LLScriptLibData *list = lsa_get_data(buffer, address, TRUE);
-                        if (!list->getListLength())
+                        if (safe_heap_check_address(buffer, address + SIZEOF_SCRIPT_ALLOC_ENTRY, 1))
                         {
-                                offset += arg;
+                                LLScriptLibData *list = lsa_get_list_ptr(buffer, base_address, TRUE);
+                                if (!list || !list->getListLength())
+                                {
+                                        offset += arg;
+                                }
+                                delete list;
                         }
                 }
         }
@@ -2954,7 +2982,7 @@ S32 axtoi(char *hexStg)
 
 BOOL run_cast(U8 *buffer, S32 &offset, BOOL b_print, const LLUUID &id)
 {
-        char caststr[1024];
+        char caststr[1024];             /*Flawfinder: ignore*/
         if (b_print)
                 printf("[0x%X]\tCAST ", offset);
         offset++;
@@ -2987,7 +3015,7 @@ BOOL run_cast(U8 *buffer, S32 &offset, BOOL b_print, const LLUUID &id)
                         case LST_STRING:
                                 {
                                         S32 address, source = lscript_pop_int(buffer);
-                                        sprintf(caststr, "%d", source);
+                                        snprintf(caststr, sizeof(caststr), "%d", source);               /*Flawfinder: ignore*/
                                         address = lsa_heap_add_data(buffer, new LLScriptLibData(caststr), get_max_heap_size(buffer), TRUE);
                                         lscript_push(buffer, address);
                                 }
@@ -3024,7 +3052,7 @@ BOOL run_cast(U8 *buffer, S32 &offset, BOOL b_print, const LLUUID &id)
                                 {
                                         S32 address;
                                         F32 source = lscript_pop_float(buffer);
-                                        sprintf(caststr, "%f", source);
+                                        snprintf(caststr, sizeof(caststr), "%f", source);               /*Flawfinder: ignore*/
                                         address = lsa_heap_add_data(buffer, new LLScriptLibData(caststr), get_max_heap_size(buffer), TRUE);
                                         lscript_push(buffer, address);
                                 }
@@ -3233,7 +3261,7 @@ BOOL run_cast(U8 *buffer, S32 &offset, BOOL b_print, const LLUUID &id)
                                         S32 address;
                                         LLVector3 source;
                                         lscript_pop_vector(buffer, source);
-                                        sprintf(caststr, "<%5.5f, %5.5f, %5.5f>", source.mV[VX], source.mV[VY], source.mV[VZ]);
+                                        snprintf(caststr, sizeof(caststr), "<%5.5f, %5.5f, %5.5f>", source.mV[VX], source.mV[VY], source.mV[VZ]);               /*Flawfinder: ignore*/
                                         address = lsa_heap_add_data(buffer, new LLScriptLibData(caststr), get_max_heap_size(buffer), TRUE);
                                         lscript_push(buffer, address);
                                 }
@@ -3266,7 +3294,7 @@ BOOL run_cast(U8 *buffer, S32 &offset, BOOL b_print, const LLUUID &id)
                                         S32 address;
                                         LLQuaternion source;
                                         lscript_pop_quaternion(buffer, source);
-                                        sprintf(caststr, "<%5.5f, %5.5f, %5.5f, %5.5f>", source.mQ[VX], source.mQ[VY], source.mQ[VZ], source.mQ[VS]);
+                                        snprintf(caststr, sizeof(caststr), "<%5.5f, %5.5f, %5.5f, %5.5f>", source.mQ[VX], source.mQ[VY], source.mQ[VZ], source.mQ[VS]);         /*Flawfinder: ignore*/
                                         address = lsa_heap_add_data(buffer, new LLScriptLibData(caststr), get_max_heap_size(buffer), TRUE);
                                         lscript_push(buffer, address);
                                 }
@@ -3590,22 +3618,29 @@ void lscript_run(char *filename, BOOL b_debug)
         char *error;
         BOOL b_state;
         LLScriptExecute *execute = NULL;
-        FILE *file = LLFile::fopen(filename, "r");
+        if (filename == NULL)
+        {
+                llerrs << "filename is empty" << llendl;
+                // Just reporting error is likely not enough. Need
+                // to check how to abort or error out gracefully
+                // from this function. XXXTBD
+        }
+        FILE* file = LLFile::fopen(filename, "r");  /* Flawfinder: ignore */
         if (file)
         {
                 execute = new LLScriptExecute(file);
                 fclose(file);
         }
-        file = LLFile::fopen(filename, "r");
+        file = LLFile::fopen(filename, "r");  /* Flawfinder: ignore */
         if (file)
         {
-                FILE *fp = LLFile::fopen("lscript.parse", "w");
+                FILE* fp = LLFile::fopen("lscript.parse", "w");         /*Flawfinder: ignore*/
                 LLScriptLSOParse        *parse = new LLScriptLSOParse(file);
                 parse->printData(fp);
                 fclose(file);
                 fclose(fp);
         }
-        file = LLFile::fopen(filename, "r");
+        file = LLFile::fopen(filename, "r");    /*Flawfinder: ignore*/
         if (file && execute)
         {
                 timer.reset();
@@ -3814,7 +3849,7 @@ BOOL run_calllib(U8 *buffer, S32 &offset, BOOL b_print, const LLUUID &id)
 
         if (gScriptLibrary.mFunctions[arg]->mArgs)
         {
-                number = (S32)strlen(gScriptLibrary.mFunctions[arg]->mArgs);
+                number = (S32)strlen(gScriptLibrary.mFunctions[arg]->mArgs);            /*Flawfinder: ignore*/
                 arguments = new LLScriptLibData[number];
         }
         else
@@ -3885,7 +3920,7 @@ BOOL run_calllib_two_byte(U8 *buffer, S32 &offset, BOOL b_print, const LLUUID &i
 
         if (gScriptLibrary.mFunctions[arg]->mArgs)
         {
-                number = (S32)strlen(gScriptLibrary.mFunctions[arg]->mArgs);
+                number = (S32)strlen(gScriptLibrary.mFunctions[arg]->mArgs);            /*Flawfinder: ignore*/
                 arguments = new LLScriptLibData[number];
         }
         else