Since the bugtracker is down, wanted to document this somewhere.

I ran scidasm under Insure++ in the directory for CB1. Insure++ detected
that the sels array was being read one past the end at index 13 in
script_dump_object(). It looks line line 459 is the culprit:
if (sels && (sels [i] >= 0) && (sels[i] < d->selector_count))


Knowing nothing about this code, it looks like the last comparison should
be (i < d->selector_count), but that doesn't appear to be the problem.
I'll take a look at this a little more when I can, but someone more versed
in this code would probably be more appropriate.


--
http://www.clock.org/~matt


Reply via email to