RomkaZVO/xash3d-fwgs
1
0
Fork 0
mirror of https://github.com/FWGS/xash3d-fwgs.git synced 2026-08-05 03:24:56 +08:00
Code Issues Packages Projects Releases Wiki Activity

engine: fix use-after-free in Netchan_CopyNormalFragments on decompression failure; reject oversized fragmented messages.

Browse Source
This commit is contained in:
Alibek Omarov
2026-05-23 02:53:26 +05:00
parent e118376735
commit f6b28e32e2
1 changed files with 10 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
engine/common/net_chan.c
View File

@@ -1097,6 +1097,16 @@ qboolean Netchan_CopyNormalFragments( netchan_t *chan, sizebuf_t *msg, size_t *l
p = n;
}
// consumed buffer, flush
chan->incomingbufs[FRAG_NORMAL_STREAM] = NULL;
chan->incomingready[FRAG_NORMAL_STREAM] = false;
if( MSG_Overflow( msg, 0 ))
{
Con_Printf( S_ERROR "%s: net_message_buffer overflow!\n", __func__ );
return false;
}
size_t size = MSG_GetNumBytesWritten( msg );
if( chan->use_bz2 && size >= 4 && !memcmp( MSG_GetData( msg ), "BZ2", 4 ))
@@ -1133,11 +1143,6 @@ qboolean Netchan_CopyNormalFragments( netchan_t *chan, sizebuf_t *msg, size_t *l
memcpy( msg->pData, buf, size );
}
chan->incomingbufs[FRAG_NORMAL_STREAM] = NULL;
// reset flag
chan->incomingready[FRAG_NORMAL_STREAM] = false;
// tell about message size
if( length ) *length = size;