Fix crash on hypertext[] with not enough parts

The length check used < rather than <=, disabling the check when the formspec version matches the client's FORMSPEC_API_VERSION. Additionally, it was possible to have fewer parts than required if the formspec version was greater than the client's FORMSPEC_API_VERSION.
minetest · Oct 25, 2021 · 8dfeba0 · 8dfeba0
1 parent 4ee643f
commit 8dfeba0
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/src/gui/guiFormSpecMenu.cpp b/src/gui/guiFormSpecMenu.cpp
@@ -1730,8 +1730,9 @@ void GUIFormSpecMenu::parseHyperText(parserData *data, const std::string &elemen
 {
 	std::vector<std::string> parts = split(element, ';');
 
-	if (parts.size() != 4 && m_formspec_version < FORMSPEC_API_VERSION) {
-		errorstream << "Invalid text element(" << parts.size() << "): '" << element << "'"  << std::endl;
+	if (parts.size() != 4 &&
+			(parts.size() < 4 || m_formspec_version <= FORMSPEC_API_VERSION)) {
+		errorstream << "Invalid hypertext element(" << parts.size() << "): '" << element << "'"  << std::endl;
 		return;
 	}