pa/eqemu-server
2
0
Fork 0
mirror of https://github.com/EQEmu/Server.git synced 2025-12-20 17:31:30 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fix issue with ControlBoat_Struct and OP_BoardBoat

Browse Source
This commit is contained in:
Michael Cook (mackal) 2014-11-16 17:42:15 -05:00
parent bd48efcdd5
commit e11fa4a278
3 changed files with 17 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
changelog.txt
View File

@ -1,5 +1,8 @@
EQEMu Changelog (Started on Sept 24, 2003 15:50) EQEMu Changelog (Started on Sept 24, 2003 15:50)
------------------------------------------------------- -------------------------------------------------------
== 11/16/2014 ==
demonstar55: fix size issue with ControlBoat_Struct and exploit fix in OP_BoardBoat
== 11/15/2014 == == 11/15/2014 ==
Uleat(Natedog): A better fix for OP_ShopPlayerBuy - doesn't cause the issues that I introduced Uleat(Natedog): A better fix for OP_ShopPlayerBuy - doesn't cause the issues that I introduced

2
common/eq_packet_structs.h
View File

@ -4383,7 +4383,7 @@ typedef struct {
struct ControlBoat_Struct { struct ControlBoat_Struct {
/*000*/ uint32 boatId; // entitylist id of the boat /*000*/ uint32 boatId; // entitylist id of the boat
/*004*/ bool TakeControl; // 01 if taking control, 00 if releasing it /*004*/ bool TakeControl; // 01 if taking control, 00 if releasing it
/*007*/ // no idea what these last three bytes represent /*007*/ char unknown[3]; // no idea what these last three bytes represent
}; };
struct AugmentInfo_Struct struct AugmentInfo_Struct

22
zone/client_packet.cpp
View File

@ -3842,19 +3842,23 @@ void Client::Handle_OP_BlockedBuffs(const EQApplicationPacket *app)
void Client::Handle_OP_BoardBoat(const EQApplicationPacket *app) void Client::Handle_OP_BoardBoat(const EQApplicationPacket *app)
{ {
// this sends unclean mob name, so capped at 64
if (app->size <= 5) // a_boat006
if (app->size <= 5 || app->size > 64) {
LogFile->write(EQEMuLog::Error, "Size mismatch in OP_BoardBoad. Expected greater than 5 less than 64, got %i", app->size);
DumpPacket(app);
return; return;
}
char *boatname; char boatname[64];
boatname = new char[app->size - 3]; memcpy(boatname, app->pBuffer, app->size);
memset(boatname, 0, app->size - 3); boatname[63] = '\0';
memcpy(boatname, app->pBuffer, app->size - 4);
Mob* boat = entity_list.GetMob(boatname); Mob* boat = entity_list.GetMob(boatname);
if (boat) if (!boat || (boat->GetRace() != CONTROLLED_BOAT && boat->GetRace() != 502))
this->BoatID = boat->GetID(); // set the client's BoatID to show that it's on this boat return;
safe_delete_array(boatname); BoatID = boat->GetID(); // set the client's BoatID to show that it's on this boat
return; return;
} }