Skip to content

Do not process packet headers or buffered messages from invalid players#8520

Open
StephenCWills wants to merge 1 commit intodiasurgical:masterfrom
StephenCWills:no-invalid-headers
Open

Do not process packet headers or buffered messages from invalid players#8520
StephenCWills wants to merge 1 commit intodiasurgical:masterfrom
StephenCWills:no-invalid-headers

Conversation

@StephenCWills
Copy link
Copy Markdown
Member

After reviewing #8519, I came to realize that the logic for validating packets from remote players does not prevent processing header data for the CMD_SEND_PLRINFO or CMD_ACK_PLRINFO messages. In that case, the packet headers synchronize player data for a player whose data hasn't been processed in the first place.

While implementing a fix for that, I also happened to notice the edge case for gbBufferMsgs == 0. This is the variable that gets assigned a value of 1 when a client who is joining a game is still receiving deltas from the host. This edge case enables the host to interleave packets between deltas that would later be processed by the remote client when the host has finished sending the deltas. These buffered packets would bypass validation and be processed regardless of whether the host had sent their player data to the client joining the game. This could, hypothetically, be used to make the joining client access uninitialized memory so I figured it was worth fixing that as well.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant