From c2c781f03946df5582b18da47435bdee359dd09e Mon Sep 17 00:00:00 2001 From: Alibek Omarov Date: Sun, 17 May 2026 11:23:55 +0500 Subject: [PATCH] engine: server: harden rcon, use constant time comparison, do not output untrusted data to log --- engine/server/sv_client.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/engine/server/sv_client.c b/engine/server/sv_client.c index 3885c5d0..099aa219 100644 --- a/engine/server/sv_client.c +++ b/engine/server/sv_client.c @@ -1041,7 +1041,7 @@ static qboolean Rcon_Validate( void ) { if( COM_StringEmptyOrNULL( rcon_password.string )) return false; - if( Q_strcmp( Cmd_Argv( 1 ), rcon_password.string )) + if( Q_strcmp_constant_time( Cmd_Argv( 1 ), rcon_password.string )) return false; return true; } @@ -1065,15 +1065,15 @@ void SV_RemoteCommand( netadr_t from, sizebuf_t *msg ) adr = NET_AdrToString( from ); - Con_Printf( "Rcon from %s:\n%s\n", adr, MSG_GetData( msg ) + 4 ); - Log_Printf( "Rcon: \"%s\" from \"%s\"\n", MSG_GetData( msg ) + 4, adr ); - if( Rcon_Validate( )) { static char outputbuf[2048]; char remaining[1024]; char *p = remaining; + Con_Printf( "Rcon from %s:\n%s\n", adr, MSG_GetData( msg ) + 4 ); + Log_Printf( "Rcon: \"%s\" from \"%s\"\n", MSG_GetData( msg ) + 4, adr ); + remaining[0] = 0; for( i = 2; i < Cmd_Argc(); i++ ) { @@ -1086,7 +1086,11 @@ void SV_RemoteCommand( netadr_t from, sizebuf_t *msg ) Cmd_ExecuteString( remaining ); SV_EndRedirect( &host.rd ); } - else Con_Printf( S_ERROR "Bad rcon_password.\n" ); + else + { + Con_Printf( S_ERROR "Bad rcon_password from %s\n", adr ); + Log_Printf( "Bad Rcon from \"%s\"\n", adr ); + } } /*