33 files changed, 257 insertions, 68 deletions

diff --git a/linden/indra/lscript/lscript_alloc.h b/linden/indra/lscript/lscript_alloc.h
index 8179446..d90cc14 100644
--- a/linden/indra/lscript/lscript_alloc.h
+++ b/linden/indra/lscript/lscript_alloc.h
@@ -2,6 +2,8 @@
  * @file lscript_alloc.h
  * @brief General heap management for scripting system
  *
+ * $LicenseInfo:firstyear=2002&license=viewergpl$
+ * 
  * Copyright (c) 2002-2007, Linden Research, Inc.
  * 
  * Second Life Viewer Source Code
@@ -24,6 +26,7 @@
  * ALL LINDEN LAB SOURCE CODE IS PROVIDED "AS IS." LINDEN LAB MAKES NO
  * WARRANTIES, EXPRESS, IMPLIED OR OTHERWISE, REGARDING ITS ACCURACY,
  * COMPLETENESS OR PERFORMANCE.
+ * $/LicenseInfo$
  */
 
 #ifndef LL_LSCRIPT_ALLOC_H
@@ -32,11 +35,8 @@
 // Under gcc 2.9, the manual is unclear if comments can appear above #ifndef
 // Under gcc 3, the manual explicitly states comments can appear above the #ifndef
 
-#include "stdtypes.h"
 #include "lscript_byteconvert.h"
 #include "lscript_library.h"
-#include "llrand.h"
-#include <stdio.h>
 
 void reset_hp_to_safe_spot(const U8 *buffer);
 
diff --git a/linden/indra/lscript/lscript_byteconvert.h b/linden/indra/lscript/lscript_byteconvert.h
index 06d494e..6d0e2d0 100644
--- a/linden/indra/lscript/lscript_byteconvert.h
+++ b/linden/indra/lscript/lscript_byteconvert.h
@@ -2,6 +2,8 @@
  * @file lscript_byteconvert.h
  * @brief Shared code for compiler and assembler for LSL
  *
+ * $LicenseInfo:firstyear=2002&license=viewergpl$
+ * 
  * Copyright (c) 2002-2007, Linden Research, Inc.
  * 
  * Second Life Viewer Source Code
@@ -24,6 +26,7 @@
  * ALL LINDEN LAB SOURCE CODE IS PROVIDED "AS IS." LINDEN LAB MAKES NO
  * WARRANTIES, EXPRESS, IMPLIED OR OTHERWISE, REGARDING ITS ACCURACY,
  * COMPLETENESS OR PERFORMANCE.
+ * $/LicenseInfo$
  */
 
 // data shared between compiler/assembler
@@ -781,9 +784,17 @@ inline S32 get_state_event_opcoode_start(U8 *stream, S32 state, LSCRIPTStateEven
                 major_version = LSL2_MAJOR_VERSION_TWO;
                 state_offset_offset = sr + LSCRIPTDataSize[LST_INTEGER] + LSCRIPTDataSize[LST_INTEGER]*3*state;
         }
+        if ( state_offset_offset < 0 || state_offset_offset > TOP_OF_MEMORY )
+        {
+                return -1;
+        }
 
         // get the actual position in memory of the desired state
         S32 state_offset = sr + bytestream2integer(stream, state_offset_offset);
+        if ( state_offset < 0 || state_offset > TOP_OF_MEMORY )
+        {
+                return -1;
+        }
 
         // save that value
         S32 state_offset_base = state_offset;
@@ -793,18 +804,32 @@ inline S32 get_state_event_opcoode_start(U8 *stream, S32 state, LSCRIPTStateEven
 
         // get the location of the event offset
         S32 event_offset = event_jump_offset + LSCRIPTDataSize[LST_INTEGER]*2*get_event_handler_jump_position(get_event_register(stream, LREG_ER, major_version), event);
+        if ( event_offset < 0 || event_offset > TOP_OF_MEMORY )
+        {
+                return -1;
+        }
 
         // now, jump to the event
         S32 event_start = bytestream2integer(stream, event_offset);
+        if ( event_start < 0 || event_start > TOP_OF_MEMORY )
+        {
+                return -1;
+        }
         event_start += event_jump_offset;
 
         S32 event_start_original = event_start;
 
         // now skip past the parameters
         S32 opcode_offset = bytestream2integer(stream, event_start);
+        if ( opcode_offset < 0 || opcode_offset > TOP_OF_MEMORY )
+        {
+                return -1;
+        }
+
         return opcode_offset + event_start_original;
 }
 
+
 inline U64 get_handled_events(U8 *stream, S32 state)
 {
         U64 retvalue = 0;
@@ -829,6 +854,7 @@ inline U64 get_handled_events(U8 *stream, S32 state)
         return retvalue;
 }
 
+// Returns -1 on error
 inline S32 get_event_stack_size(U8 *stream, S32 state, LSCRIPTStateEventType event)
 {
         // get the start of the state table
@@ -849,21 +875,39 @@ inline S32 get_event_stack_size(U8 *stream, S32 state, LSCRIPTStateEventType eve
                 state_offset_offset = sr + LSCRIPTDataSize[LST_INTEGER] + LSCRIPTDataSize[LST_INTEGER]*3*state;
         }
 
+        if ( state_offset_offset < 0 || state_offset_offset > TOP_OF_MEMORY )
+        {
+                return -1;
+        }
+
         S32 state_offset = bytestream2integer(stream, state_offset_offset);
         state_offset += sr;
 
         state_offset_offset = state_offset;
+        if ( state_offset_offset < 0 || state_offset_offset > TOP_OF_MEMORY )
+        {
+                return -1;
+        }
 
         // skip to jump table
         S32 jump_table = bytestream2integer(stream, state_offset_offset);
 
         jump_table += state_offset;
+        if ( jump_table < 0 || jump_table > TOP_OF_MEMORY )
+        {
+                return -1;
+        }
 
         // get the position of the jump to the desired state
         S32 stack_size_offset = jump_table + LSCRIPTDataSize[LST_INTEGER]*2*get_event_handler_jump_position(get_event_register(stream, LREG_ER, major_version), event) + LSCRIPTDataSize[LST_INTEGER];
 
         // get the handled events
         S32 stack_size = bytestream2integer(stream, stack_size_offset);
+        if ( stack_size < 0 || stack_size > TOP_OF_MEMORY )
+        {
+                return -1;
+        }
+
         return stack_size;
 }
 
diff --git a/linden/indra/lscript/lscript_byteformat.h b/linden/indra/lscript/lscript_byteformat.h
index 2feee9f..4e8f13f 100644
--- a/linden/indra/lscript/lscript_byteformat.h
+++ b/linden/indra/lscript/lscript_byteformat.h
@@ -2,6 +2,8 @@
  * @file lscript_byteformat.h
  * @brief Shared code between compiler and assembler and LSL
  *
+ * $LicenseInfo:firstyear=2002&license=viewergpl$
+ * 
  * Copyright (c) 2002-2007, Linden Research, Inc.
  * 
  * Second Life Viewer Source Code
@@ -24,6 +26,7 @@
  * ALL LINDEN LAB SOURCE CODE IS PROVIDED "AS IS." LINDEN LAB MAKES NO
  * WARRANTIES, EXPRESS, IMPLIED OR OTHERWISE, REGARDING ITS ACCURACY,
  * COMPLETENESS OR PERFORMANCE.
+ * $/LicenseInfo$
  */
 
 #ifndef LL_LSCRIPT_BYTEFORMAT_H
diff --git a/linden/indra/lscript/lscript_compile/indra.l b/linden/indra/lscript/lscript_compile/indra.l
index de5ba11..69e77fb 100644
--- a/linden/indra/lscript/lscript_compile/indra.l
+++ b/linden/indra/lscript/lscript_compile/indra.l
@@ -9,13 +9,15 @@ FS			(f|F)
 %p 5000
 
 %{
-#include <stdio.h>
-#include "stdtypes.h"
+#include "linden_common.h"
+// Deal with the fact that lex/yacc generates unreachable code
+#ifdef LL_WINDOWS
+#pragma warning (disable : 4702) // warning C4702: unreachable code
+#endif  //      LL_WINDOWS
 #include "llmath.h"
 #include "lscript_tree.h"
 #include "lscript_typecheck.h"
 #include "lscript_resource.h"
-#include "llfile.h"
 #if LL_WINDOWS
 #include "ytab.h"
 #else
diff --git a/linden/indra/lscript/lscript_compile/indra.y b/linden/indra/lscript/lscript_compile/indra.y
index 56f40c9..d10cbfe 100644
--- a/linden/indra/lscript/lscript_compile/indra.y
+++ b/linden/indra/lscript/lscript_compile/indra.y
@@ -1,7 +1,7 @@
 %{
-        #include "stdtypes.h"
+        #include "linden_common.h"
         #include "lscript_tree.h"
-        
+
     #ifdef __cplusplus
     extern "C" {
     #endif
@@ -16,6 +16,7 @@
     #endif
 
     #ifdef LL_WINDOWS
+        #pragma warning (disable : 4702) // warning C4702: unreachable code
         #pragma warning( disable : 4065 )       // warning: switch statement contains 'default' but no 'case' labels
         #endif
 
diff --git a/linden/indra/lscript/lscript_compile/lscript_alloc.cpp b/linden/indra/lscript/lscript_compile/lscript_alloc.cpp
index 9298524..873fc36 100644
--- a/linden/indra/lscript/lscript_compile/lscript_alloc.cpp
+++ b/linden/indra/lscript/lscript_compile/lscript_alloc.cpp
@@ -2,6 +2,8 @@
  * @file lscript_alloc.cpp
  * @brief Allocation tracking
  *
+ * $LicenseInfo:firstyear=2002&license=viewergpl$
+ * 
  * Copyright (c) 2002-2007, Linden Research, Inc.
  * 
  * Second Life Viewer Source Code
@@ -24,5 +26,6 @@
  * ALL LINDEN LAB SOURCE CODE IS PROVIDED "AS IS." LINDEN LAB MAKES NO
  * WARRANTIES, EXPRESS, IMPLIED OR OTHERWISE, REGARDING ITS ACCURACY,
  * COMPLETENESS OR PERFORMANCE.
+ * $/LicenseInfo$
  */
 
diff --git a/linden/indra/lscript/lscript_compile/lscript_bytecode.cpp b/linden/indra/lscript/lscript_compile/lscript_bytecode.cpp
index 0d75eee..c41c34c 100644
--- a/linden/indra/lscript/lscript_compile/lscript_bytecode.cpp
+++ b/linden/indra/lscript/lscript_compile/lscript_bytecode.cpp
@@ -2,6 +2,8 @@
  * @file lscript_bytecode.cpp
  * @brief classes to build actual bytecode
  *
+ * $LicenseInfo:firstyear=2002&license=viewergpl$
+ * 
  * Copyright (c) 2002-2007, Linden Research, Inc.
  * 
  * Second Life Viewer Source Code
@@ -24,6 +26,7 @@
  * ALL LINDEN LAB SOURCE CODE IS PROVIDED "AS IS." LINDEN LAB MAKES NO
  * WARRANTIES, EXPRESS, IMPLIED OR OTHERWISE, REGARDING ITS ACCURACY,
  * COMPLETENESS OR PERFORMANCE.
+ * $/LicenseInfo$
  */
 
 #include "linden_common.h"
diff --git a/linden/indra/lscript/lscript_compile/lscript_bytecode.h b/linden/indra/lscript/lscript_compile/lscript_bytecode.h
index 2dd4719..8db031a 100644
--- a/linden/indra/lscript/lscript_compile/lscript_bytecode.h
+++ b/linden/indra/lscript/lscript_compile/lscript_bytecode.h
@@ -2,6 +2,8 @@
  * @file lscript_bytecode.h
  * @brief classes to build actual bytecode
  *
+ * $LicenseInfo:firstyear=2002&license=viewergpl$
+ * 
  * Copyright (c) 2002-2007, Linden Research, Inc.
  * 
  * Second Life Viewer Source Code
@@ -24,6 +26,7 @@
  * ALL LINDEN LAB SOURCE CODE IS PROVIDED "AS IS." LINDEN LAB MAKES NO
  * WARRANTIES, EXPRESS, IMPLIED OR OTHERWISE, REGARDING ITS ACCURACY,
  * COMPLETENESS OR PERFORMANCE.
+ * $/LicenseInfo$
  */
 
 #ifndef LL_LSCRIPT_BYTECODE_H
diff --git a/linden/indra/lscript/lscript_compile/lscript_error.cpp b/linden/indra/lscript/lscript_compile/lscript_error.cpp
index d54bbb4..f4960fc 100644
--- a/linden/indra/lscript/lscript_compile/lscript_error.cpp
+++ b/linden/indra/lscript/lscript_compile/lscript_error.cpp
@@ -2,6 +2,8 @@
  * @file lscript_error.cpp
  * @brief error reporting class and strings
  *
+ * $LicenseInfo:firstyear=2002&license=viewergpl$
+ * 
  * Copyright (c) 2002-2007, Linden Research, Inc.
  * 
  * Second Life Viewer Source Code
@@ -24,6 +26,7 @@
  * ALL LINDEN LAB SOURCE CODE IS PROVIDED "AS IS." LINDEN LAB MAKES NO
  * WARRANTIES, EXPRESS, IMPLIED OR OTHERWISE, REGARDING ITS ACCURACY,
  * COMPLETENESS OR PERFORMANCE.
+ * $/LicenseInfo$
  */
 
 #include "linden_common.h"
diff --git a/linden/indra/lscript/lscript_compile/lscript_error.h b/linden/indra/lscript/lscript_compile/lscript_error.h
index c795b0c..aba3932 100644
--- a/linden/indra/lscript/lscript_compile/lscript_error.h
+++ b/linden/indra/lscript/lscript_compile/lscript_error.h
@@ -2,6 +2,8 @@
  * @file lscript_error.h
  * @brief error reporting class and strings
  *
+ * $LicenseInfo:firstyear=2002&license=viewergpl$
+ * 
  * Copyright (c) 2002-2007, Linden Research, Inc.
  * 
  * Second Life Viewer Source Code
@@ -24,16 +26,14 @@
  * ALL LINDEN LAB SOURCE CODE IS PROVIDED "AS IS." LINDEN LAB MAKES NO
  * WARRANTIES, EXPRESS, IMPLIED OR OTHERWISE, REGARDING ITS ACCURACY,
  * COMPLETENESS OR PERFORMANCE.
+ * $/LicenseInfo$
  */
 
 #ifndef LL_LSCRIPT_ERROR_H
 #define LL_LSCRIPT_ERROR_H
 
-#include <stdio.h>
-#include "stdtypes.h"
 #include "lscript_scope.h"
 
-
 typedef enum e_lscript_compile_pass
 {
         LSCP_INVALID,
diff --git a/linden/indra/lscript/lscript_compile/lscript_heap.cpp b/linden/indra/lscript/lscript_compile/lscript_heap.cpp
index 33c52e7..7242b72 100644
--- a/linden/indra/lscript/lscript_compile/lscript_heap.cpp
+++ b/linden/indra/lscript/lscript_compile/lscript_heap.cpp
@@ -2,6 +2,8 @@
  * @file lscript_heap.cpp
  * @brief classes to manage script heap
  *
+ * $LicenseInfo:firstyear=2002&license=viewergpl$
+ * 
  * Copyright (c) 2002-2007, Linden Research, Inc.
  * 
  * Second Life Viewer Source Code
@@ -24,6 +26,7 @@
  * ALL LINDEN LAB SOURCE CODE IS PROVIDED "AS IS." LINDEN LAB MAKES NO
  * WARRANTIES, EXPRESS, IMPLIED OR OTHERWISE, REGARDING ITS ACCURACY,
  * COMPLETENESS OR PERFORMANCE.
+ * $/LicenseInfo$
  */
 
 #if 0
diff --git a/linden/indra/lscript/lscript_compile/lscript_heap.h b/linden/indra/lscript/lscript_compile/lscript_heap.h
index 2c55abc..a06466a 100644
--- a/linden/indra/lscript/lscript_compile/lscript_heap.h
+++ b/linden/indra/lscript/lscript_compile/lscript_heap.h
@@ -2,6 +2,8 @@
  * @file lscript_heap.h
  * @brief classes to manage script heap
  *
+ * $LicenseInfo:firstyear=2002&license=viewergpl$
+ * 
  * Copyright (c) 2002-2007, Linden Research, Inc.
  * 
  * Second Life Viewer Source Code
@@ -24,6 +26,7 @@
  * ALL LINDEN LAB SOURCE CODE IS PROVIDED "AS IS." LINDEN LAB MAKES NO
  * WARRANTIES, EXPRESS, IMPLIED OR OTHERWISE, REGARDING ITS ACCURACY,
  * COMPLETENESS OR PERFORMANCE.
+ * $/LicenseInfo$
  */
 
 #if 0
diff --git a/linden/indra/lscript/lscript_compile/lscript_resource.cpp b/linden/indra/lscript/lscript_compile/lscript_resource.cpp
index 4747524..0e01385 100644
--- a/linden/indra/lscript/lscript_compile/lscript_resource.cpp
+++ b/linden/indra/lscript/lscript_compile/lscript_resource.cpp
@@ -2,6 +2,8 @@
  * @file lscript_resource.cpp
  * @brief resource determination prior to assembly
  *
+ * $LicenseInfo:firstyear=2002&license=viewergpl$
+ * 
  * Copyright (c) 2002-2007, Linden Research, Inc.
  * 
  * Second Life Viewer Source Code
@@ -24,6 +26,7 @@
  * ALL LINDEN LAB SOURCE CODE IS PROVIDED "AS IS." LINDEN LAB MAKES NO
  * WARRANTIES, EXPRESS, IMPLIED OR OTHERWISE, REGARDING ITS ACCURACY,
  * COMPLETENESS OR PERFORMANCE.
+ * $/LicenseInfo$
  */
 
 #include "linden_common.h"
diff --git a/linden/indra/lscript/lscript_compile/lscript_resource.h b/linden/indra/lscript/lscript_compile/lscript_resource.h
index 91e9e70..80e6c83 100644
--- a/linden/indra/lscript/lscript_compile/lscript_resource.h
+++ b/linden/indra/lscript/lscript_compile/lscript_resource.h
@@ -2,6 +2,8 @@
  * @file lscript_resource.h
  * @brief resource determination prior to assembly
  *
+ * $LicenseInfo:firstyear=2002&license=viewergpl$
+ * 
  * Copyright (c) 2002-2007, Linden Research, Inc.
  * 
  * Second Life Viewer Source Code
@@ -24,13 +26,12 @@
  * ALL LINDEN LAB SOURCE CODE IS PROVIDED "AS IS." LINDEN LAB MAKES NO
  * WARRANTIES, EXPRESS, IMPLIED OR OTHERWISE, REGARDING ITS ACCURACY,
  * COMPLETENESS OR PERFORMANCE.
+ * $/LicenseInfo$
  */
 
 #ifndef LL_LSCRIPT_RESOURCE_H
 #define LL_LSCRIPT_RESOURCE_H
 
-#include <stdio.h>
-#include "stdtypes.h"
 #include "lscript_scope.h"
 
 void init_temp_jumps();
diff --git a/linden/indra/lscript/lscript_compile/lscript_scope.cpp b/linden/indra/lscript/lscript_compile/lscript_scope.cpp
index 747327b..4d00661 100644
--- a/linden/indra/lscript/lscript_compile/lscript_scope.cpp
+++ b/linden/indra/lscript/lscript_compile/lscript_scope.cpp
@@ -2,6 +2,8 @@
  * @file lscript_scope.cpp
  * @brief builds nametable and checks scope
  *
+ * $LicenseInfo:firstyear=2002&license=viewergpl$
+ * 
  * Copyright (c) 2002-2007, Linden Research, Inc.
  * 
  * Second Life Viewer Source Code
@@ -24,6 +26,7 @@
  * ALL LINDEN LAB SOURCE CODE IS PROVIDED "AS IS." LINDEN LAB MAKES NO
  * WARRANTIES, EXPRESS, IMPLIED OR OTHERWISE, REGARDING ITS ACCURACY,
  * COMPLETENESS OR PERFORMANCE.
+ * $/LicenseInfo$
  */
 
 #include "linden_common.h"
diff --git a/linden/indra/lscript/lscript_compile/lscript_scope.h b/linden/indra/lscript/lscript_compile/lscript_scope.h
index 2b82d4b..c55d995 100644
--- a/linden/indra/lscript/lscript_compile/lscript_scope.h
+++ b/linden/indra/lscript/lscript_compile/lscript_scope.h
@@ -2,6 +2,8 @@
  * @file lscript_scope.h
  * @brief builds nametable and checks scope
  *
+ * $LicenseInfo:firstyear=2002&license=viewergpl$
+ * 
  * Copyright (c) 2002-2007, Linden Research, Inc.
  * 
  * Second Life Viewer Source Code
@@ -24,6 +26,7 @@
  * ALL LINDEN LAB SOURCE CODE IS PROVIDED "AS IS." LINDEN LAB MAKES NO
  * WARRANTIES, EXPRESS, IMPLIED OR OTHERWISE, REGARDING ITS ACCURACY,
  * COMPLETENESS OR PERFORMANCE.
+ * $/LicenseInfo$
  */
 
 #ifndef LL_LSCRIPT_SCOPE_H
diff --git a/linden/indra/lscript/lscript_compile/lscript_tree.cpp b/linden/indra/lscript/lscript_compile/lscript_tree.cpp
index 075418d..cad6fc2 100644
--- a/linden/indra/lscript/lscript_compile/lscript_tree.cpp
+++ b/linden/indra/lscript/lscript_compile/lscript_tree.cpp
@@ -2,6 +2,8 @@
  * @file lscript_tree.cpp
  * @brief implements methods for lscript_tree.h classes
  *
+ * $LicenseInfo:firstyear=2002&license=viewergpl$
+ * 
  * Copyright (c) 2002-2007, Linden Research, Inc.
  * 
  * Second Life Viewer Source Code
@@ -24,6 +26,7 @@
  * ALL LINDEN LAB SOURCE CODE IS PROVIDED "AS IS." LINDEN LAB MAKES NO
  * WARRANTIES, EXPRESS, IMPLIED OR OTHERWISE, REGARDING ITS ACCURACY,
  * COMPLETENESS OR PERFORMANCE.
+ * $/LicenseInfo$
  */
 
 // TO DO: Move print functionality from .h file to here
diff --git a/linden/indra/lscript/lscript_compile/lscript_tree.h b/linden/indra/lscript/lscript_compile/lscript_tree.h
index a70db87..fee648e 100644
--- a/linden/indra/lscript/lscript_compile/lscript_tree.h
+++ b/linden/indra/lscript/lscript_compile/lscript_tree.h
@@ -2,6 +2,8 @@
  * @file lscript_tree.h
  * @brief provides the classes required to build lscript's abstract syntax tree and symbol table
  *
+ * $LicenseInfo:firstyear=2002&license=viewergpl$
+ * 
  * Copyright (c) 2002-2007, Linden Research, Inc.
  * 
  * Second Life Viewer Source Code
@@ -24,13 +26,12 @@
  * ALL LINDEN LAB SOURCE CODE IS PROVIDED "AS IS." LINDEN LAB MAKES NO
  * WARRANTIES, EXPRESS, IMPLIED OR OTHERWISE, REGARDING ITS ACCURACY,
  * COMPLETENESS OR PERFORMANCE.
+ * $/LicenseInfo$
  */
 
 #ifndef LL_LSCRIPT_TREE_H
 #define LL_LSCRIPT_TREE_H
 
-#include <stdio.h>
-#include "stdtypes.h"
 #include "v3math.h"
 #include "llquaternion.h"
 #include "linked_lists.h"
diff --git a/linden/indra/lscript/lscript_compile/lscript_typecheck.cpp b/linden/indra/lscript/lscript_compile/lscript_typecheck.cpp
index 9fa7720..847a54e 100644
--- a/linden/indra/lscript/lscript_compile/lscript_typecheck.cpp
+++ b/linden/indra/lscript/lscript_compile/lscript_typecheck.cpp
@@ -2,6 +2,8 @@
  * @file lscript_typecheck.cpp
  * @brief typechecks script
  *
+ * $LicenseInfo:firstyear=2002&license=viewergpl$
+ * 
  * Copyright (c) 2002-2007, Linden Research, Inc.
  * 
  * Second Life Viewer Source Code
@@ -24,6 +26,7 @@
  * ALL LINDEN LAB SOURCE CODE IS PROVIDED "AS IS." LINDEN LAB MAKES NO
  * WARRANTIES, EXPRESS, IMPLIED OR OTHERWISE, REGARDING ITS ACCURACY,
  * COMPLETENESS OR PERFORMANCE.
+ * $/LicenseInfo$
  */
 
 #include "linden_common.h"
diff --git a/linden/indra/lscript/lscript_compile/lscript_typecheck.h b/linden/indra/lscript/lscript_compile/lscript_typecheck.h
index c10d11b..0ebae2d 100644
--- a/linden/indra/lscript/lscript_compile/lscript_typecheck.h
+++ b/linden/indra/lscript/lscript_compile/lscript_typecheck.h
@@ -2,6 +2,8 @@
  * @file lscript_typecheck.h
  * @brief typechecks script
  *
+ * $LicenseInfo:firstyear=2002&license=viewergpl$
+ * 
  * Copyright (c) 2002-2007, Linden Research, Inc.
  * 
  * Second Life Viewer Source Code
@@ -24,6 +26,7 @@
  * ALL LINDEN LAB SOURCE CODE IS PROVIDED "AS IS." LINDEN LAB MAKES NO
  * WARRANTIES, EXPRESS, IMPLIED OR OTHERWISE, REGARDING ITS ACCURACY,
  * COMPLETENESS OR PERFORMANCE.
+ * $/LicenseInfo$
  */
 
 #ifndef LL_LSCRIPT_TYPECHECK_H
diff --git a/linden/indra/lscript/lscript_execute.h b/linden/indra/lscript/lscript_execute.h
index 82109fd..1e11d32 100644
--- a/linden/indra/lscript/lscript_execute.h
+++ b/linden/indra/lscript/lscript_execute.h
@@ -2,6 +2,8 @@
  * @file lscript_execute.h
  * @brief Classes to execute bytecode
  *
+ * $LicenseInfo:firstyear=2002&license=viewergpl$
+ * 
  * Copyright (c) 2002-2007, Linden Research, Inc.
  * 
  * Second Life Viewer Source Code
@@ -24,12 +26,12 @@
  * ALL LINDEN LAB SOURCE CODE IS PROVIDED "AS IS." LINDEN LAB MAKES NO
  * WARRANTIES, EXPRESS, IMPLIED OR OTHERWISE, REGARDING ITS ACCURACY,
  * COMPLETENESS OR PERFORMANCE.
+ * $/LicenseInfo$
  */
 
 #ifndef LL_LSCRIPT_EXECUTE_H
 #define LL_LSCRIPT_EXECUTE_H
 
-#include <stdio.h>
 #include "lscript_byteconvert.h"
 #include "linked_lists.h"
 #include "lscript_library.h"
@@ -379,6 +381,10 @@ public:
         LLScriptEventData               mEventData;
 
         static S64 sGlobalInstructionCount;
+
+private:
+        void            recordBoundaryError( const LLUUID &id );
+        void            setStateEventOpcoodeStartSafely( S32 state, LSCRIPTStateEventType event, const LLUUID &id );
 };
 
 #endif
diff --git a/linden/indra/lscript/lscript_execute/lscript_execute.cpp b/linden/indra/lscript/lscript_execute/lscript_execute.cpp
index 9e8be15..5bbbc47 100644
--- a/linden/indra/lscript/lscript_execute/lscript_execute.cpp
+++ b/linden/indra/lscript/lscript_execute/lscript_execute.cpp
@@ -2,6 +2,8 @@
  * @file lscript_execute.cpp
  * @brief classes to execute bytecode
  *
+ * $LicenseInfo:firstyear=2002&license=viewergpl$
+ * 
  * Copyright (c) 2002-2007, Linden Research, Inc.
  * 
  * Second Life Viewer Source Code
@@ -24,6 +26,7 @@
  * ALL LINDEN LAB SOURCE CODE IS PROVIDED "AS IS." LINDEN LAB MAKES NO
  * WARRANTIES, EXPRESS, IMPLIED OR OTHERWISE, REGARDING ITS ACCURACY,
  * COMPLETENESS OR PERFORMANCE.
+ * $/LicenseInfo$
  */
 
 #include "linden_common.h"
@@ -265,6 +268,32 @@ void LLScriptExecute::init()
 
 }
 
+
+// Utility routine for when there's a boundary error parsing bytecode
+void LLScriptExecute::recordBoundaryError( const LLUUID &id )
+{
+        set_fault(mBuffer, LSRF_BOUND_CHECK_ERROR);
+        llwarns << "Script boundary error for ID " << id << llendl;
+}
+
+
+//      set IP to the event handler with some error checking
+void LLScriptExecute::setStateEventOpcoodeStartSafely( S32 state, LSCRIPTStateEventType event, const LLUUID &id )
+{
+        S32                     opcode_start = get_state_event_opcoode_start( mBuffer, state, event );
+        if ( opcode_start == -1 )
+        {
+                recordBoundaryError( id );
+        }
+        else
+        {
+                set_ip( mBuffer, opcode_start );
+        }
+}
+
+
+
+
 S32 lscript_push_variable(LLScriptLibData *data, U8 *buffer);
 
 U32 LLScriptExecute::run(BOOL b_print, const LLUUID &id, char **errorstr, BOOL &state_transition)
@@ -373,14 +402,20 @@ U32 LLScriptExecute::run(BOOL b_print, const LLUUID &id, char **errorstr, BOOL &
 
                 //                      now, push any additional stack space
                                         S32 additional_size = get_event_stack_size(mBuffer, current_state, LSTT_STATE_EXIT);
-                                        lscript_pusharge(mBuffer, additional_size);
-
-                                        sp = get_register(mBuffer, LREG_SP);
-                                        sp += additional_size;
-                                        set_bp(mBuffer, sp);
-        //                              set IP to the event handler
-                                        S32                     opcode_start = get_state_event_opcoode_start(mBuffer, current_state, LSTT_STATE_EXIT);
-                                        set_ip(mBuffer, opcode_start);
+                                        if ( additional_size == -1 )
+                                        {       
+                                                recordBoundaryError( id );
+                                        }
+                                        else
+                                        {
+                                                lscript_pusharge(mBuffer, additional_size);
+
+                                                sp = get_register(mBuffer, LREG_SP);
+                                                sp += additional_size;
+                                                set_bp(mBuffer, sp);
+                //                              set IP to the event handler
+                                                setStateEventOpcoodeStartSafely( current_state, LSTT_STATE_EXIT, id );
+                                        }
                                         return NO_DELETE_FLAG;
                                 }
                         }
@@ -431,20 +466,27 @@ U32 LLScriptExecute::run(BOOL b_print, const LLUUID &id, char **errorstr, BOOL &
                         current_events &= ~LSCRIPTStateBitField[event];
                         set_event_register(mBuffer, LREG_CE, current_events, major_version);
 //                      now, push any additional stack space
-                        S32 additional_size = get_event_stack_size(mBuffer, current_state, event) - size;
-                        lscript_pusharge(mBuffer, additional_size);
+                        S32 additional_size = get_event_stack_size(mBuffer, current_state, event);
+                        if ( additional_size == -1 )
+                        {       // b_done will be set, so we'll exit the loop at the bottom
+                                recordBoundaryError( id );
+                        }
+                        else
+                        {
+                                additional_size -= size;
+                                lscript_pusharge(mBuffer, additional_size);
 
 //                      now set the bp correctly
-                        sp = get_register(mBuffer, LREG_SP);
-                        sp += additional_size + size;
-                        set_bp(mBuffer, sp);
+                                sp = get_register(mBuffer, LREG_SP);
+                                sp += additional_size + size;
+                                set_bp(mBuffer, sp);
 //                      set IP to the function
-                        S32                     opcode_start = get_state_event_opcoode_start(mBuffer, current_state, event);
-                        set_ip(mBuffer, opcode_start);
+                                setStateEventOpcoodeStartSafely( current_state, event, id );
+                        }
                         b_done = TRUE;
                 }
                 else if (  (current_events & LSCRIPTStateBitField[LSTT_REZ])
-                                 &&(current_events & event_register))
+                                &&(current_events & event_register))
                 {
                         for (eventdata = mEventData.mEventDataList.getFirstData(); eventdata; eventdata = mEventData.mEventDataList.getNextData())
                         {
@@ -469,17 +511,24 @@ U32 LLScriptExecute::run(BOOL b_print, const LLUUID &id, char **errorstr, BOOL &
                                                 data++;
                                         }
                 //                      now, push any additional stack space
-                                        S32 additional_size = get_event_stack_size(mBuffer, current_state, event) - size;
-                                        lscript_pusharge(mBuffer, additional_size);
-
-                //                      now set the bp correctly
-                                        sp = get_register(mBuffer, LREG_SP);
-                                        sp += additional_size + size;
-                                        set_bp(mBuffer, sp);
-                //                      set IP to the function
-                                        S32                     opcode_start = get_state_event_opcoode_start(mBuffer, current_state, event);
-                                        set_ip(mBuffer, opcode_start);
-                                        mEventData.mEventDataList.deleteCurrentData();
+                                        S32 additional_size = get_event_stack_size(mBuffer, current_state, event);
+                                        if ( additional_size == -1 )
+                                        {       // b_done will be set, so we'll exit the loop at the bottom
+                                                recordBoundaryError( id );
+                                        }
+                                        else
+                                        {
+                                                additional_size -= size;
+                                                lscript_pusharge(mBuffer, additional_size);
+
+                        //                      now set the bp correctly
+                                                sp = get_register(mBuffer, LREG_SP);
+                                                sp += additional_size + size;
+                                                set_bp(mBuffer, sp);
+                        //                      set IP to the function
+                                                setStateEventOpcoodeStartSafely( current_state, event, id );
+                                                mEventData.mEventDataList.deleteCurrentData();
+                                        }
                                         b_done = TRUE;
                                         break;
                                 }
@@ -516,16 +565,23 @@ U32 LLScriptExecute::run(BOOL b_print, const LLUUID &id, char **errorstr, BOOL &
                                         }
                                         b_done = TRUE;
                 //                      now, push any additional stack space
-                                        S32 additional_size = get_event_stack_size(mBuffer, current_state, event) - size;
-                                        lscript_pusharge(mBuffer, additional_size);
-
-                //                      now set the bp correctly
-                                        sp = get_register(mBuffer, LREG_SP);
-                                        sp += additional_size + size;
-                                        set_bp(mBuffer, sp);
-                //                      set IP to the function
-                                        S32                     opcode_start = get_state_event_opcoode_start(mBuffer, current_state, event);
-                                        set_ip(mBuffer, opcode_start);
+                                        S32 additional_size = get_event_stack_size(mBuffer, current_state, event);
+                                        if ( additional_size == -1 )
+                                        {       // b_done was just set, so we'll exit the loop at the bottom
+                                                recordBoundaryError( id );
+                                        }
+                                        else
+                                        {
+                                                additional_size -= size;
+                                                lscript_pusharge(mBuffer, additional_size);
+
+                        //                      now set the bp correctly
+                                                sp = get_register(mBuffer, LREG_SP);
+                                                sp += additional_size + size;
+                                                set_bp(mBuffer, sp);
+                        //                      set IP to the function
+                                                setStateEventOpcoodeStartSafely( current_state, event, id );
+                                        }
                                 }
                                 else
                                 {
@@ -550,23 +606,30 @@ U32 LLScriptExecute::run(BOOL b_print, const LLUUID &id, char **errorstr, BOOL &
                                         current_events &= ~LSCRIPTStateBitField[event];
                                         set_event_register(mBuffer, LREG_CE, current_events, major_version);
                 //                      now, push any additional stack space
-                                        S32 additional_size = get_event_stack_size(mBuffer, current_state, event) - size;
-                                        lscript_pusharge(mBuffer, additional_size);
-
-                //                      now set the bp correctly
-                                        sp = get_register(mBuffer, LREG_SP);
-                                        sp += additional_size + size;
-                                        set_bp(mBuffer, sp);
-                //                      set IP to the function
-                                        S32                     opcode_start = get_state_event_opcoode_start(mBuffer, current_state, event);
-                                        set_ip(mBuffer, opcode_start);
+                                        S32 additional_size = get_event_stack_size(mBuffer, current_state, event);
+                                        if ( additional_size == -1 )
+                                        {       // b_done will be set, so we'll exit the loop at the bottom
+                                                recordBoundaryError( id );
+                                        }
+                                        else
+                                        {
+                                                additional_size -= size;
+                                                lscript_pusharge(mBuffer, additional_size);
+
+                        //                      now set the bp correctly
+                                                sp = get_register(mBuffer, LREG_SP);
+                                                sp += additional_size + size;
+                                                set_bp(mBuffer, sp);
+                        //                      set IP to the function
+                                                setStateEventOpcoodeStartSafely( current_state, event, id );
+                                        }
                                 }
                                 b_done = TRUE;
                         }
-                }
+                }       // while (!b_done)
+        } // end of else ...  in state processing code
 
-                return NO_DELETE_FLAG;
-        }
+        return NO_DELETE_FLAG;
 }
 
 BOOL run_noop(U8 *buffer, S32 &offset, BOOL b_print, const LLUUID &id)
diff --git a/linden/indra/lscript/lscript_execute/lscript_heapruntime.cpp b/linden/indra/lscript/lscript_execute/lscript_heapruntime.cpp
index 073a736..057db79 100644
--- a/linden/indra/lscript/lscript_execute/lscript_heapruntime.cpp
+++ b/linden/indra/lscript/lscript_execute/lscript_heapruntime.cpp
@@ -2,6 +2,8 @@
  * @file lscript_heapruntime.cpp
  * @brief classes to manage script heap at runtime
  *
+ * $LicenseInfo:firstyear=2002&license=viewergpl$
+ * 
  * Copyright (c) 2002-2007, Linden Research, Inc.
  * 
  * Second Life Viewer Source Code
@@ -24,6 +26,7 @@
  * ALL LINDEN LAB SOURCE CODE IS PROVIDED "AS IS." LINDEN LAB MAKES NO
  * WARRANTIES, EXPRESS, IMPLIED OR OTHERWISE, REGARDING ITS ACCURACY,
  * COMPLETENESS OR PERFORMANCE.
+ * $/LicenseInfo$
  */
 
 #if 0
diff --git a/linden/indra/lscript/lscript_execute/lscript_heapruntime.h b/linden/indra/lscript/lscript_execute/lscript_heapruntime.h
index 8431ea5..c4ade6c 100644
--- a/linden/indra/lscript/lscript_execute/lscript_heapruntime.h
+++ b/linden/indra/lscript/lscript_execute/lscript_heapruntime.h
@@ -2,6 +2,8 @@
  * @file lscript_heapruntime.h
  * @brief classes to manage script heap at runtime
  *
+ * $LicenseInfo:firstyear=2002&license=viewergpl$
+ * 
  * Copyright (c) 2002-2007, Linden Research, Inc.
  * 
  * Second Life Viewer Source Code
@@ -24,6 +26,7 @@
  * ALL LINDEN LAB SOURCE CODE IS PROVIDED "AS IS." LINDEN LAB MAKES NO
  * WARRANTIES, EXPRESS, IMPLIED OR OTHERWISE, REGARDING ITS ACCURACY,
  * COMPLETENESS OR PERFORMANCE.
+ * $/LicenseInfo$
  */
 
 #if 0
diff --git a/linden/indra/lscript/lscript_execute/lscript_readlso.cpp b/linden/indra/lscript/lscript_execute/lscript_readlso.cpp
index f84abc5..8ecd8cd 100644
--- a/linden/indra/lscript/lscript_execute/lscript_readlso.cpp
+++ b/linden/indra/lscript/lscript_execute/lscript_readlso.cpp
@@ -2,6 +2,8 @@
  * @file lscript_readlso.cpp
  * @brief classes to read lso file
  *
+ * $LicenseInfo:firstyear=2002&license=viewergpl$
+ * 
  * Copyright (c) 2002-2007, Linden Research, Inc.
  * 
  * Second Life Viewer Source Code
@@ -24,6 +26,7 @@
  * ALL LINDEN LAB SOURCE CODE IS PROVIDED "AS IS." LINDEN LAB MAKES NO
  * WARRANTIES, EXPRESS, IMPLIED OR OTHERWISE, REGARDING ITS ACCURACY,
  * COMPLETENESS OR PERFORMANCE.
+ * $/LicenseInfo$
  */
 
 #include "linden_common.h"
diff --git a/linden/indra/lscript/lscript_execute/lscript_readlso.h b/linden/indra/lscript/lscript_execute/lscript_readlso.h
index 8fa5211..92c9dfa 100644
--- a/linden/indra/lscript/lscript_execute/lscript_readlso.h
+++ b/linden/indra/lscript/lscript_execute/lscript_readlso.h
@@ -2,6 +2,8 @@
  * @file lscript_readlso.h
  * @brief classes to read lso file
  *
+ * $LicenseInfo:firstyear=2002&license=viewergpl$
+ * 
  * Copyright (c) 2002-2007, Linden Research, Inc.
  * 
  * Second Life Viewer Source Code
@@ -24,6 +26,7 @@
  * ALL LINDEN LAB SOURCE CODE IS PROVIDED "AS IS." LINDEN LAB MAKES NO
  * WARRANTIES, EXPRESS, IMPLIED OR OTHERWISE, REGARDING ITS ACCURACY,
  * COMPLETENESS OR PERFORMANCE.
+ * $/LicenseInfo$
  */
 
 #ifndef LL_LSCRIPT_READLSO_H
diff --git a/linden/indra/lscript/lscript_export.h b/linden/indra/lscript/lscript_export.h
index d9f7f18..0384569 100644
--- a/linden/indra/lscript/lscript_export.h
+++ b/linden/indra/lscript/lscript_export.h
@@ -2,6 +2,8 @@
  * @file lscript_export.h
  * @brief Export interface class
  *
+ * $LicenseInfo:firstyear=2002&license=viewergpl$
+ * 
  * Copyright (c) 2002-2007, Linden Research, Inc.
  * 
  * Second Life Viewer Source Code
@@ -24,6 +26,7 @@
  * ALL LINDEN LAB SOURCE CODE IS PROVIDED "AS IS." LINDEN LAB MAKES NO
  * WARRANTIES, EXPRESS, IMPLIED OR OTHERWISE, REGARDING ITS ACCURACY,
  * COMPLETENESS OR PERFORMANCE.
+ * $/LicenseInfo$
  */
 
 #ifndef LL_LSCRIPT_EXPORT_H
diff --git a/linden/indra/lscript/lscript_http.h b/linden/indra/lscript/lscript_http.h
index c562093..cb60090 100644
--- a/linden/indra/lscript/lscript_http.h
+++ b/linden/indra/lscript/lscript_http.h
@@ -2,6 +2,8 @@
  * @file lscript_http.h
  * @brief LSL HTTP keys
  *
+ * $LicenseInfo:firstyear=2006&license=viewergpl$
+ * 
  * Copyright (c) 2006-2007, Linden Research, Inc.
  * 
  * Second Life Viewer Source Code
@@ -24,6 +26,7 @@
  * ALL LINDEN LAB SOURCE CODE IS PROVIDED "AS IS." LINDEN LAB MAKES NO
  * WARRANTIES, EXPRESS, IMPLIED OR OTHERWISE, REGARDING ITS ACCURACY,
  * COMPLETENESS OR PERFORMANCE.
+ * $/LicenseInfo$
  */
 
 // Keys used in LSL HTTP function <key,value> pair lists.
diff --git a/linden/indra/lscript/lscript_library.h b/linden/indra/lscript/lscript_library.h
index 353ff69..a15805f 100644
--- a/linden/indra/lscript/lscript_library.h
+++ b/linden/indra/lscript/lscript_library.h
@@ -2,6 +2,8 @@
  * @file lscript_library.h
  * @brief External library interface
  *
+ * $LicenseInfo:firstyear=2002&license=viewergpl$
+ * 
  * Copyright (c) 2002-2007, Linden Research, Inc.
  * 
  * Second Life Viewer Source Code
@@ -24,6 +26,7 @@
  * ALL LINDEN LAB SOURCE CODE IS PROVIDED "AS IS." LINDEN LAB MAKES NO
  * WARRANTIES, EXPRESS, IMPLIED OR OTHERWISE, REGARDING ITS ACCURACY,
  * COMPLETENESS OR PERFORMANCE.
+ * $/LicenseInfo$
  */
 
 #ifndef LL_LSCRIPT_LIBRARY_H
@@ -34,7 +37,6 @@
 #include "llquaternion.h"
 #include "lluuid.h"
 #include "lscript_byteconvert.h"
-#include <stdio.h>
 
 class LLScriptLibData;
 
diff --git a/linden/indra/lscript/lscript_library/lscript_alloc.cpp b/linden/indra/lscript/lscript_library/lscript_alloc.cpp
index 99e6917..a2f83e7 100644
--- a/linden/indra/lscript/lscript_library/lscript_alloc.cpp
+++ b/linden/indra/lscript/lscript_library/lscript_alloc.cpp
@@ -2,6 +2,8 @@
  * @file lscript_alloc.cpp
  * @brief general heap management for scripting system
  *
+ * $LicenseInfo:firstyear=2002&license=viewergpl$
+ * 
  * Copyright (c) 2002-2007, Linden Research, Inc.
  * 
  * Second Life Viewer Source Code
@@ -24,6 +26,7 @@
  * ALL LINDEN LAB SOURCE CODE IS PROVIDED "AS IS." LINDEN LAB MAKES NO
  * WARRANTIES, EXPRESS, IMPLIED OR OTHERWISE, REGARDING ITS ACCURACY,
  * COMPLETENESS OR PERFORMANCE.
+ * $/LicenseInfo$
  */
 
 // #define at top of file accelerates gcc compiles
@@ -31,8 +34,8 @@
 // Under gcc 3, the manual explicitly states comments can appear above the #ifndef
 
 #include "linden_common.h"
-
 #include "lscript_alloc.h"
+#include "llrand.h"
 
 // supported data types
 
diff --git a/linden/indra/lscript/lscript_library/lscript_export.cpp b/linden/indra/lscript/lscript_library/lscript_export.cpp
index be95d30..26d1361 100644
--- a/linden/indra/lscript/lscript_library/lscript_export.cpp
+++ b/linden/indra/lscript/lscript_library/lscript_export.cpp
@@ -2,6 +2,8 @@
  * @file lscript_export.cpp
  * @brief export interface class
  *
+ * $LicenseInfo:firstyear=2002&license=viewergpl$
+ * 
  * Copyright (c) 2002-2007, Linden Research, Inc.
  * 
  * Second Life Viewer Source Code
@@ -24,5 +26,6 @@
  * ALL LINDEN LAB SOURCE CODE IS PROVIDED "AS IS." LINDEN LAB MAKES NO
  * WARRANTIES, EXPRESS, IMPLIED OR OTHERWISE, REGARDING ITS ACCURACY,
  * COMPLETENESS OR PERFORMANCE.
+ * $/LicenseInfo$
  */
 
diff --git a/linden/indra/lscript/lscript_library/lscript_library.cpp b/linden/indra/lscript/lscript_library/lscript_library.cpp
index 3f939c4..e082220 100644
--- a/linden/indra/lscript/lscript_library/lscript_library.cpp
+++ b/linden/indra/lscript/lscript_library/lscript_library.cpp
@@ -2,6 +2,8 @@
  * @file lscript_library.cpp
  * @brief external library interface
  *
+ * $LicenseInfo:firstyear=2002&license=viewergpl$
+ * 
  * Copyright (c) 2002-2007, Linden Research, Inc.
  * 
  * Second Life Viewer Source Code
@@ -24,6 +26,7 @@
  * ALL LINDEN LAB SOURCE CODE IS PROVIDED "AS IS." LINDEN LAB MAKES NO
  * WARRANTIES, EXPRESS, IMPLIED OR OTHERWISE, REGARDING ITS ACCURACY,
  * COMPLETENESS OR PERFORMANCE.
+ * $/LicenseInfo$
  */
 
 // *WARNING*
diff --git a/linden/indra/lscript/lscript_rt_interface.h b/linden/indra/lscript/lscript_rt_interface.h
index f595cbe..791c447 100644
--- a/linden/indra/lscript/lscript_rt_interface.h
+++ b/linden/indra/lscript/lscript_rt_interface.h
@@ -2,6 +2,8 @@
  * @file lscript_rt_interface.h
  * @brief Interface between compiler library and applications
  *
+ * $LicenseInfo:firstyear=2002&license=viewergpl$
+ * 
  * Copyright (c) 2002-2007, Linden Research, Inc.
  * 
  * Second Life Viewer Source Code
@@ -24,6 +26,7 @@
  * ALL LINDEN LAB SOURCE CODE IS PROVIDED "AS IS." LINDEN LAB MAKES NO
  * WARRANTIES, EXPRESS, IMPLIED OR OTHERWISE, REGARDING ITS ACCURACY,
  * COMPLETENESS OR PERFORMANCE.
+ * $/LicenseInfo$
  */
 
 #ifndef LL_LSCRIPT_RT_INTERFACE_H