Mirroristas/rathena
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

* Fixed potential hack by modifying packet of whispers.

Browse Source 
modified   Changelog-Trunk.txt
modified   src/map/clif.c
 

git-svn-id: https://svn.code.sf.net/p/rathena/svn/trunk@9249 54d463be-8e91-2dee-dedb-b68131a5f0ec
This commit is contained in:
Lance
2006-11-17 17:27:19 +00:00
parent d4e8bbe4b2
commit a7d5f271df
2 changed files with 14 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
Changelog-Trunk.txt
View File

@@ -4,6 +4,7 @@ AS OF SVN REV. 5091, WE ARE NOW USING TRUNK. ALL UNTESTED BUGFIXES/FEATURES GO
IF YOU HAVE A WORKING AND TESTED BUGFIX PUT IT INTO STABLE AS WELL AS TRUNK.
2006/11/17
* Fixed potential hack by modifying packet of whispers. [Lance]
* Fixed potential crash in IRC processing message with '%' using *printf. [Lance]
* Fixed memory leaking caused by homun_data not freed when removed. [Lance]
* Fixed client not validating the chat-kick-request packet, which can cause

15
src/map/clif.c
View File

@@ -9055,12 +9055,23 @@ void clif_parse_Wis(int fd, struct map_session_data *sd) { // S 0096 <len>.w <ni
struct npc_data *npc;
char split_data[10][50];
char target[NAME_LENGTH+1];
char output[256];
char output[256];
unsigned int speclen, scanlen;
RFIFOHEAD(fd);
//printf("clif_parse_Wis: message: '%s'.\n", RFIFOP(fd,28));
gm_command = (char*)aMallocA((strlen((const char*)RFIFOP(fd,28)) + 28)*sizeof(char)); // 24+3+(RFIFOW(fd,2)-28)+1 or 24+3+(strlen(RFIFOP(fd,28))+1 (size can be wrong with hacker)
// Prevent hacked packets like missing null terminator or wrong len specification. [Lance]
speclen = (unsigned int)RFIFOW(fd,2);
scanlen = strlen((const char*)RFIFOP(fd,28)) + 28;
if(scanlen != speclen){
ShowWarning("Hack on Whisper: %s (AID: %d)!\n", sd->status.name, sd->bl.id);
clif_GM_kick(sd,sd,0);
return;
}
gm_command = (char*)aMallocA(speclen * sizeof(char)); // 24+3+(RFIFOW(fd,2)-28)+1 or 24+3+(strlen(RFIFOP(fd,28))+1 (size can be wrong with hacker)
sprintf(gm_command, "%s : %s", sd->status.name, RFIFOP(fd,28));
if ((is_charcommand(fd, sd, gm_command) != CharCommand_None) ||