OoBs memory access bug in FileChoose_LoadGame

[mzxrules]

https://github.com/zeldaret/oot/blob/master/src/overlays/gamestates/ovl_file_choose/z_file_choose.c#L1501

If swordEquipMask is 0, an out of bounds memory access will occur. This naturally happens when loading a new game, as the player's B button isn't assigned to a sword item, and gSaveContext.equips.equipment's sword bits are 0. The only reason odd behavior doesn't occur on N64 is that the data at index -1 is either a null pointer or padding, effectively becoming a no op

[Dragorn421]

To reword this issue:

Consider this block of code

oot/src/overlays/gamestates/ovl_file_choose/z_file_choose.c

Lines 1505 to 1515 in 185c9cb

 if ((gSaveContext.save.info.equips.buttonItems[0] != ITEM_SWORD_KOKIRI) && 
     (gSaveContext.save.info.equips.buttonItems[0] != ITEM_SWORD_MASTER) && 
     (gSaveContext.save.info.equips.buttonItems[0] != ITEM_SWORD_BIGGORON) && 
     (gSaveContext.save.info.equips.buttonItems[0] != ITEM_GIANTS_KNIFE)) { 
  
     gSaveContext.save.info.equips.buttonItems[0] = ITEM_NONE; 
     swordEquipValue = 
         (gEquipMasks[EQUIP_TYPE_SWORD] & gSaveContext.save.info.equips.equipment) >> (EQUIP_TYPE_SWORD * 4); 
     gSaveContext.save.info.equips.equipment &= gEquipNegMasks[EQUIP_TYPE_SWORD]; 
     gSaveContext.save.info.inventory.equipment ^= OWNED_EQUIP_FLAG(EQUIP_TYPE_SWORD, swordEquipValue - 1); 
 } 

it is in function

oot/src/overlays/gamestates/ovl_file_choose/z_file_choose.c

Line 1437 in 185c9cb

 void FileSelect_LoadGame(GameState* thisx) { 

This function runs also when a newly created file is loaded, at which point the current b button item is not a sword (it's "no item"). so this condition passes and the block executes

then swordEquipValue gets 0 (EQUIP_VALUE_SWORD_NONE)

oot/src/overlays/gamestates/ovl_file_choose/z_file_choose.c

Lines 1511 to 1512 in 185c9cb

 swordEquipValue = 
     (gEquipMasks[EQUIP_TYPE_SWORD] & gSaveContext.save.info.equips.equipment) >> (EQUIP_TYPE_SWORD * 4); 

then on

oot/src/overlays/gamestates/ovl_file_choose/z_file_choose.c

Line 1514 in 185c9cb

 gSaveContext.save.info.inventory.equipment ^= OWNED_EQUIP_FLAG(EQUIP_TYPE_SWORD, swordEquipValue - 1); 

the right hand side expands to (gBitFlags[swordEquipValue - 1] << gEquipShifts[EQUIP_TYPE_SWORD])
which uses gBitFlags[-1]

and that's an OOB access which apparently turns out to be fine (must load a 0 I guess)