From 8dfeba02b9f084ddd52090ccd906534200f468b3 Mon Sep 17 00:00:00 2001 From: rubenwardy Date: Mon, 25 Oct 2021 21:36:28 +0100 Subject: [PATCH] Fix crash on hypertext[] with not enough parts The length check used < rather than <=, disabling the check when the formspec version matches the client's FORMSPEC_API_VERSION. Additionally, it was possible to have fewer parts than required if the formspec version was greater than the client's FORMSPEC_API_VERSION. --- src/gui/guiFormSpecMenu.cpp | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/gui/guiFormSpecMenu.cpp b/src/gui/guiFormSpecMenu.cpp index 938481fa2..1ce55673d 100644 --- a/src/gui/guiFormSpecMenu.cpp +++ b/src/gui/guiFormSpecMenu.cpp @@ -1730,8 +1730,9 @@ void GUIFormSpecMenu::parseHyperText(parserData *data, const std::string &elemen { std::vector parts = split(element, ';'); - if (parts.size() != 4 && m_formspec_version < FORMSPEC_API_VERSION) { - errorstream << "Invalid text element(" << parts.size() << "): '" << element << "'" << std::endl; + if (parts.size() != 4 && + (parts.size() < 4 || m_formspec_version <= FORMSPEC_API_VERSION)) { + errorstream << "Invalid hypertext element(" << parts.size() << "): '" << element << "'" << std::endl; return; }