Changes

| Unholy Heights

| Unholy Heights

| Buffer overflow via unchecked string size

| Buffer overflow via unchecked string size

| The game stores some utf-16 messages in the savefile. Right before the message is the length(u32) for the string, the game uses this size to memcpy the message from the savefile to the stack without checking the length. This allows one to overwrite to some function addresses on the stack and form a rop chain.

| The game stores some utf-16 messages in the savefile. Right before the message is the length(u32) for the string, the game uses this size to memcpy the message from the savefile to the stack without checking the length. This allows one to overwrite some function addresses on the stack and form a rop chain.

| None

| None

| App: Initial Version

| App: Initial Version