In Teeworlds 0.7.2, there is an integer overflow in CMap::Load() in engine/shared/map.cpp that can lead to a buffer overflow, because multiplication of width and height is mishandled.
{ "binaries": [ { "binary_version": "0.6.2+dfsg-2", "binary_name": "teeworlds" }, { "binary_version": "0.6.2+dfsg-2", "binary_name": "teeworlds-data" }, { "binary_version": "0.6.2+dfsg-2", "binary_name": "teeworlds-server" } ] }
{ "binaries": [ { "binary_version": "0.6.4+dfsg-1", "binary_name": "teeworlds" }, { "binary_version": "0.6.4+dfsg-1", "binary_name": "teeworlds-data" }, { "binary_version": "0.6.4+dfsg-1", "binary_name": "teeworlds-server" } ] }
{ "binaries": [ { "binary_version": "0.7.2-5", "binary_name": "teeworlds" }, { "binary_version": "0.7.2-5", "binary_name": "teeworlds-data" }, { "binary_version": "0.7.2-5", "binary_name": "teeworlds-server" } ], "availability": "No subscription required" }