diff --git a/changelog.txt b/changelog.txt index 731cf4cfc..fc815952e 100644 --- a/changelog.txt +++ b/changelog.txt @@ -3,6 +3,7 @@ EQEMu Changelog (Started on Sept 24, 2003 15:50) == 04/27/2013 == Pixel Bounds: Verify OP_Ack size & fix crash in BasePacket::build_raw_header_dump due to uninitialised timestamp. +Derision: Verify minimum size of OP_Packet, OP_Fragment and OP_OutOfOrderAck. == 04/24/2013 == Bad_Captain: Fixed a couple of merc stat issues. diff --git a/common/EQStream.cpp b/common/EQStream.cpp index 7c179fab7..ae5c6953c 100644 --- a/common/EQStream.cpp +++ b/common/EQStream.cpp @@ -173,6 +173,11 @@ uint32 processed=0,subpacket_length=0; break; case OP_Packet: { + if(!p->pBuffer || (p->Size() < 4)) + { + _log(NET__ERROR, _L "Received OP_Packet that was of malformed size" __L); + break; + } uint16 seq=ntohs(*(uint16 *)(p->pBuffer)); SeqOrder check=CompareSequence(NextInSeq,seq); if (check == SeqFuture) { @@ -218,6 +223,11 @@ uint32 processed=0,subpacket_length=0; break; case OP_Fragment: { + if(!p->pBuffer || (p->Size() < 4)) + { + _log(NET__ERROR, _L "Received OP_Fragment that was of malformed size" __L); + break; + } uint16 seq=ntohs(*(uint16 *)(p->pBuffer)); SeqOrder check=CompareSequence(NextInSeq,seq); if (check == SeqFuture) { @@ -388,6 +398,11 @@ uint32 processed=0,subpacket_length=0; } break; case OP_OutOfOrderAck: { + if(!p->pBuffer || (p->Size() < 4)) + { + _log(NET__ERROR, _L "Received OP_OutOfOrderAck that was of malformed size" __L); + break; + } #ifndef COLLECTOR uint16 seq=ntohs(*(uint16 *)(p->pBuffer)); MOutboundQueue.lock();