Skip to content

Fix out-of-bounds crash in PluginIterator_Next #2445

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
SCP-076 wants to merge 3 commits into
base: master
Choose a base branch
from
+11 −7
Open

Fix out-of-bounds crash in PluginIterator_Next #2445

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
beca65b
Fix OOB dereference in PluginIterator methodmap (#1880)
SCP-076 Apr 22, 2026
3b6238a
Add defense-in-depth safeguards to CMMPluginIterator
SCP-076 Apr 22, 2026
b0a521a
Update PluginIterator.Next() @error documentation
SCP-076 Apr 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 10 additions & 6 deletions core/logic/smn_core.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -151,6 +151,8 @@ class CMMPluginIterator
}
virtual IPlugin *GetPlugin() override
{
if (m_current == m_list.end())
return nullptr;
return *m_current;
}
virtual void NextPlugin() override
Expand All @@ -161,7 +163,8 @@ class CMMPluginIterator
return;
}

m_current++;
if (m_current != m_list.end())
m_current++;
}
virtual void Release() override
{
Expand All @@ -171,7 +174,7 @@ class CMMPluginIterator
public:
virtual void OnPluginDestroyed(IPlugin *plugin) override
{
if (*m_current == plugin)
if (m_current != m_list.end() && *m_current == plugin)
m_current = m_list.erase(m_current);
else
m_list.remove(static_cast<SMPlugin *>(plugin));
Expand Down Expand Up @@ -401,12 +404,13 @@ static cell_t PluginIterator_Next(IPluginContext *pContext, const cell_t *params
{
return pContext->ThrowNativeError("Could not read Handle %x (error %d)", hndl, err);
}

if(!pIter->MorePlugins())
return 0;

return pContext->ThrowNativeError("PluginIterator %x is exhausted.", hndl);
pIter->NextPlugin();
return 1;

return pIter->MorePlugins() ? 1 : 0;
}

static cell_t PluginIterator_Plugin_get(IPluginContext *pContext, const cell_t *params)
Expand Down
2 changes: 1 addition & 1 deletion plugins/include/sourcemod.inc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -262,7 +262,7 @@ methodmap PluginIterator < Handle
// Advances the iterator. Returns whether there are more plugins available in the iterator.
//
// @return True on more plugins, false otherwise.
// @error Invalid Handle.
// @error Invalid Handle, or called when the iterator is already exhausted.
public native bool Next();

// Returns the current plugin in the iterator.
Expand Down