suburb

Nanosvg integer overflow

1

```c etlegacy/src/renderercommon/nanosvg/nanosvgrast.h:959:41: runtime error: left shift of 255 by 24 places cannot be represented in type 'int' etlegacy/src/renderercommon/nanosvg/nanosvgrast.h:873:17: runtime error: -2.90581e+09 is outside the range of representable values of type...

```c etlegacy/src/game/bg_pmove.c:575:11: runtime error: division by zero ``` https://github.com/etlegacy/etlegacy/blob/737c75b45cd042674fcb70d750fbf5ac4565a484/src/game/bg_pmove.c#L575

Campaigns out of bounds access

2

On game initialization: ```c etlegacy/src/game/g_main.c:2478:18: runtime error: index -1 out of bounds for type 'g_campaignInfo_t [512]' ``` https://github.com/etlegacy/etlegacy/blob/737c75b45cd042674fcb70d750fbf5ac4565a484/src/game/g_main.c#L2478

Multiple divisions by zero if `level.frameTime` is zero: https://github.com/etlegacy/etlegacy/blob/021dbda6d785c4dc14cdf0d22594bae95ca17796/src/game/g_main.c#L5383 https://github.com/etlegacy/etlegacy/blob/021dbda6d785c4dc14cdf0d22594bae95ca17796/src/game/g_main.c#L5240 ```c etlegacy/src/game/g_main.c:5251:3: runtime error: division by zero etlegacy/src/game/g_main.c:5251:3: runtime error: division by zero etlegacy/src/game/g_main.c:5251:3: runtime error: division by zero etlegacy/src/game/g_main.c:5296:2:...

The following will always evaluate as `true`: https://github.com/etlegacy/etlegacy/blob/ace50f1b7087903b04d7150970c6ee8dd08a07e8/src/cgame/cg_event.c#L2003 https://github.com/etlegacy/etlegacy/blob/ace50f1b7087903b04d7150970c6ee8dd08a07e8/src/cgame/cg_locations.c#L375 https://github.com/etlegacy/etlegacy/blob/ace50f1b7087903b04d7150970c6ee8dd08a07e8/src/server/sv_demo.c#L1840

``` etlegacy/src/renderer/tr_cmds.c:238:17: runtime error: member access within misaligned address 0x7f0af141c854 for type 'struct stretchPicCommand_t', which requires 8 byte alignment 0x7f0af141c854: note: pointer points here 00 00 80 3f 00 00...

This causes an overflow here: https://github.com/etlegacy/etlegacy/blob/ace50f1b7087903b04d7150970c6ee8dd08a07e8/src/cgame/cg_ents.c#L339-L341 https://github.com/etlegacy/etlegacy/blob/ace50f1b7087903b04d7150970c6ee8dd08a07e8/src/cgame/cg_effects.c#L166-L168 ```c etlegacy/src/cgame/cg_effects.c:166:42: runtime error: 326.776 is outside the range of representable values of type 'unsigned char' etlegacy/src/cgame/cg_effects.c:167:42: runtime error: 326.776 is outside the...

Happens for example if there is no objective text in limbo menu https://github.com/etlegacy/etlegacy/blob/ace50f1b7087903b04d7150970c6ee8dd08a07e8/src/cgame/cg_newDraw.c#L127 https://github.com/etlegacy/etlegacy/blob/ace50f1b7087903b04d7150970c6ee8dd08a07e8/src/ui/ui_shared.c#L1896

Occasionally happens when breakables are destroyed ```c etlegacy/src/renderer/tr_decals.c:954:32: runtime error: -689.219 is outside the range of representable values of type 'unsigned char' etlegacy/src/renderer/tr_decals.c:955:32: runtime error: -689.219 is outside the range...

Sample leak with `r_cache 1`: ``` Direct leak of 120 byte(s) in 1 object(s) allocated from: #0 0x7f5ff89fd867 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145 #1 0x559c3bd6aaa9 in R_CacheImageAlloc etlegacy/src/renderer/tr_image.c:1958 #2 0x559c3bd6aceb in R_CreateImage...