fix: WDT MWMO parser used unbounded strlen on chunk data

std::strlen on raw MWMO chunk data has no upper bound if the chunk
lacks a null terminator (truncated/corrupt WDT file). Replaced with
strnlen bounded by chunkSize, matching the ADT parser fix in d776226f.
This commit is contained in:
Kelsi 2026-03-29 20:26:58 -07:00
parent 7f5cad63cd
commit a1575ec678

View file

@ -69,7 +69,9 @@ WDTInfo parseWDT(const std::vector<uint8_t>& data) {
// Null-terminated WMO path string(s)
if (chunkSize > 0) {
const char* str = reinterpret_cast<const char*>(chunkData);
size_t len = std::strlen(str);
// Bound scan to chunkSize to avoid OOB read on truncated files
// (strlen has no upper bound if the data lacks a null terminator).
size_t len = strnlen(str, chunkSize);
if (len > 0) {
info.rootWMOPath = std::string(str, len);
LOG_DEBUG("WDT root WMO: ", info.rootWMOPath);