Skip to content

Commit b578bf4

Browse files
committed
Guard Squirrel constructor_stub() invocations from invalid class parameters
This prevents manual invocations of the native class constructor for non-class values or non-native classes.
1 parent 655679e commit b578bf4

1 file changed

Lines changed: 12 additions & 9 deletions

File tree

sp/src/vscript/vscript_squirrel.cpp

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1332,15 +1332,10 @@ SQInteger function_stub(HSQUIRRELVM vm)
13321332
{
13331333
SQInteger top = sq_gettop(vm);
13341334

1335-
SQUserPointer userptr = nullptr;
1336-
if (SQ_FAILED(sq_getuserpointer(vm, top, &userptr)))
1337-
{
1338-
return sq_throwerror(vm, "Expected userpointer");
1339-
}
1335+
ScriptFunctionBinding_t* pFunc = nullptr;
1336+
sq_getuserpointer(vm, top, (SQUserPointer*)&pFunc);
13401337

1341-
Assert(userptr);
1342-
1343-
ScriptFunctionBinding_t* pFunc = (ScriptFunctionBinding_t*)userptr;
1338+
Assert(pFunc);
13441339

13451340
int nargs = pFunc->m_desc.m_Parameters.Count();
13461341
int nLastHScriptIdx = -1;
@@ -1548,7 +1543,15 @@ SQInteger destructor_stub_instance(SQUserPointer p, SQInteger size)
15481543
SQInteger constructor_stub(HSQUIRRELVM vm)
15491544
{
15501545
ScriptClassDesc_t* pClassDesc = nullptr;
1551-
sq_gettypetag(vm, 1, (SQUserPointer*)&pClassDesc);
1546+
if (SQ_FAILED(sq_gettypetag(vm, 1, (SQUserPointer*)&pClassDesc)))
1547+
{
1548+
return sq_throwerror(vm, "Expected native class");
1549+
}
1550+
1551+
if (!pClassDesc || (void*)pClassDesc == TYPETAG_VECTOR)
1552+
{
1553+
return sq_throwerror(vm, "Unable to obtain native class description");
1554+
}
15521555

15531556
if (!pClassDesc->m_pfnConstruct)
15541557
{

0 commit comments

Comments
 (0)