From d305292340eb3babb00d85ff2e4c28985f9e0583 Mon Sep 17 00:00:00 2001 From: Alibek Omarov Date: Sat, 16 May 2026 12:56:45 +0500 Subject: [PATCH] engine: zone: in CheckAlloc walk through over both allocation chains, so that we don't read out of bounds if passed pointer is not allocated by zone allocator --- engine/common/zone.c | 26 ++++++++++---------------- 1 file changed, 10 insertions(+), 16 deletions(-) diff --git a/engine/common/zone.c b/engine/common/zone.c index e163d3a0..d8b92554 100644 --- a/engine/common/zone.c +++ b/engine/common/zone.c @@ -576,25 +576,19 @@ static qboolean Mem_CheckAlloc( mempool_t *pool, void *data ) { if( pool ) { - if( Mem_ReadSentinel( data ) == MEMHEADER_SENTINEL_SMALL ) - { - memheader_small_t *target = (memheader_small_t *)((byte *)data - sizeof( memheader_small_t )); + memheader_t *target_big = (memheader_t *)((byte *)data - sizeof( memheader_t )); + memheader_small_t *target_small = (memheader_small_t *)((byte *)data - sizeof( memheader_small_t )); - for( memheader_small_t *header = pool->chain_small; header; header = header->next ) - { - if( header == target ) - return true; - } + for( memheader_t *header = pool->chain; header; header = header->next ) + { + if( header == target_big ) + return true; } - else - { - memheader_t *target = (memheader_t *)((byte *)data - sizeof( memheader_t )); - for( memheader_t *header = pool->chain; header; header = header->next ) - { - if( header == target ) - return true; - } + for( memheader_small_t *header = pool->chain_small; header; header = header->next ) + { + if( header == target_small ) + return true; } } else