pa/eqemu-server
2
0
Fork 0
mirror of https://github.com/EQEmu/Server.git synced 2025-12-13 18:51:29 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Verify minimum size of OP_Packet, OP_Fragment and OP_OutOfOrderAck

Browse Source
This commit is contained in:
Derision 2013-04-27 16:22:29 +01:00
parent 401e897019
commit 232d1e2ca8
2 changed files with 16 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
changelog.txt
View File

@ -3,6 +3,7 @@ EQEMu Changelog (Started on Sept 24, 2003 15:50)
== 04/27/2013 == == 04/27/2013 ==
Pixel Bounds: Verify OP_Ack size & fix crash in BasePacket::build_raw_header_dump due to uninitialised timestamp. Pixel Bounds: Verify OP_Ack size & fix crash in BasePacket::build_raw_header_dump due to uninitialised timestamp.
Derision: Verify minimum size of OP_Packet, OP_Fragment and OP_OutOfOrderAck.
== 04/24/2013 == == 04/24/2013 ==
Bad_Captain: Fixed a couple of merc stat issues. Bad_Captain: Fixed a couple of merc stat issues.

15
common/EQStream.cpp
View File

@ -173,6 +173,11 @@ uint32 processed=0,subpacket_length=0;
break; break;
case OP_Packet: { case OP_Packet: {
if(!p->pBuffer || (p->Size() < 4))
{
_log(NET__ERROR, _L "Received OP_Packet that was of malformed size" __L);
break;
}
uint16 seq=ntohs(*(uint16 *)(p->pBuffer)); uint16 seq=ntohs(*(uint16 *)(p->pBuffer));
SeqOrder check=CompareSequence(NextInSeq,seq); SeqOrder check=CompareSequence(NextInSeq,seq);
if (check == SeqFuture) { if (check == SeqFuture) {
@ -218,6 +223,11 @@ uint32 processed=0,subpacket_length=0;
break; break;
case OP_Fragment: { case OP_Fragment: {
if(!p->pBuffer || (p->Size() < 4))
{
_log(NET__ERROR, _L "Received OP_Fragment that was of malformed size" __L);
break;
}
uint16 seq=ntohs(*(uint16 *)(p->pBuffer)); uint16 seq=ntohs(*(uint16 *)(p->pBuffer));
SeqOrder check=CompareSequence(NextInSeq,seq); SeqOrder check=CompareSequence(NextInSeq,seq);
if (check == SeqFuture) { if (check == SeqFuture) {
@ -388,6 +398,11 @@ uint32 processed=0,subpacket_length=0;
} }
break; break;
case OP_OutOfOrderAck: { case OP_OutOfOrderAck: {
if(!p->pBuffer || (p->Size() < 4))
{
_log(NET__ERROR, _L "Received OP_OutOfOrderAck that was of malformed size" __L);
break;
}
#ifndef COLLECTOR #ifndef COLLECTOR
uint16 seq=ntohs(*(uint16 *)(p->pBuffer)); uint16 seq=ntohs(*(uint16 *)(p->pBuffer));
MOutboundQueue.lock(); MOutboundQueue.lock();