pa/eqemu-server
2
0
Fork 0
mirror of https://github.com/EQEmu/Server.git synced 2025-12-16 01:01:30 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fix issue with ControlBoat_Struct and OP_BoardBoat

Browse Source
This commit is contained in:
Michael Cook (mackal) 2014-11-16 17:42:15 -05:00
parent bd48efcdd5
commit e11fa4a278
3 changed files with 17 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
changelog.txt
View File

@ -1,5 +1,8 @@
EQEMu Changelog (Started on Sept 24, 2003 15:50)
-------------------------------------------------------
== 11/16/2014 ==
demonstar55: fix size issue with ControlBoat_Struct and exploit fix in OP_BoardBoat
== 11/15/2014 ==
Uleat(Natedog): A better fix for OP_ShopPlayerBuy - doesn't cause the issues that I introduced

2
common/eq_packet_structs.h
View File

@ -4383,7 +4383,7 @@ typedef struct {
struct ControlBoat_Struct {
/*000*/ uint32 boatId; // entitylist id of the boat
/*004*/ bool TakeControl; // 01 if taking control, 00 if releasing it
/*007*/ // no idea what these last three bytes represent
/*007*/ char unknown[3]; // no idea what these last three bytes represent
};
struct AugmentInfo_Struct

22
zone/client_packet.cpp
View File

@ -3842,19 +3842,23 @@ void Client::Handle_OP_BlockedBuffs(const EQApplicationPacket *app)
void Client::Handle_OP_BoardBoat(const EQApplicationPacket *app)
{
if (app->size <= 5)
// this sends unclean mob name, so capped at 64
// a_boat006
if (app->size <= 5 || app->size > 64) {
LogFile->write(EQEMuLog::Error, "Size mismatch in OP_BoardBoad. Expected greater than 5 less than 64, got %i", app->size);
DumpPacket(app);
return;
}
char *boatname;
boatname = new char[app->size - 3];
memset(boatname, 0, app->size - 3);
memcpy(boatname, app->pBuffer, app->size - 4);
char boatname[64];
memcpy(boatname, app->pBuffer, app->size);
boatname[63] = '\0';
Mob* boat = entity_list.GetMob(boatname);
if (boat)
this->BoatID = boat->GetID(); // set the client's BoatID to show that it's on this boat
safe_delete_array(boatname);
if (!boat || (boat->GetRace() != CONTROLLED_BOAT && boat->GetRace() != 502))
return;
BoatID = boat->GetID(); // set the client's BoatID to show that it's on this boat
return;
}