Some more error checking for class names and tangible IDs

2024-02-28 14:19:59 -05:00
parent 32dae0df5a
commit 0c126e62d6
8 changed files with 77 additions and 21 deletions
--- a/luprex/cpp/core/serializelua.cpp
+++ b/luprex/cpp/core/serializelua.cpp
@@ -80,11 +80,19 @@ class Deserializer {
                return;
            }
            case LUA_TT_TANGIBLE: {
-                LS_.maketan(target, sb_->read_int64());
+                int64_t tanid = sb_->read_int64();
+                if (!LS_.validpositiveint64(tanid)) {
+                    throw DeserializeError();
+                }
+                LS_.maketan(target, tanid);
                return;
            }
            case LUA_TT_CLASS: {
-                LS_.makeclass(target, sb_->read_string());
+                eng::string name = sb_->read_string();
+                if (!LS_.validclassname(name)) {
+                    throw DeserializeError();
+                }
+                LS_.makeclass(target, name);
                return;
            }
            case LUA_PK_REFERENCE: {