Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

BUG: fix rcon_crypt for any size of time_t #726

Open
VVD opened this issue Jan 1, 2023 · 0 comments
Open

BUG: fix rcon_crypt for any size of time_t #726

VVD opened this issue Jan 1, 2023 · 0 comments

Comments

@VVD
Copy link

VVD commented Jan 1, 2023

ezQuake version:
3.2.3

Describe the bug

time(&client_time);

time want time_t, if time_t == int128_t and we try to call it with pointer to 64bit => segmentation fault and/or broken stack.
So always use time_t and fixed size (32 or 64 bit) for hex in rcon is better way.
ezQuake with this patch work for me with current mvdsv without any changes:

--- common.h.orig
+++ common.h
@@ -436,5 +436,7 @@
 unsigned char *Q_redtext(unsigned char *str);
 unsigned char *Q_yelltext(unsigned char *str);
 
+#define TIME_T_SIZE    8
+
 #endif /* !__COMMON_H__ */
 
--- cl_cmd.c.orig
+++ cl_cmd.c
@@ -84,7 +84,7 @@
 // don't forward the first argument
 void CL_ForwardToServer_f (void) {
 // Added by VVD {
-       char            *server_string, client_time_str[9];
+       char            *server_string, client_time_str[TIME_T_SIZE * 2 + 1];
        int             i, server_string_len;
        extern cvar_t   cl_crypt_rcon;
        time_t          client_time;
@@ -131,13 +131,13 @@
                if (cl_crypt_rcon.value && strcasecmp(Cmd_Argv(1), "techlogin") == 0 && Cmd_Argc() > 2)
                {
                        time(&client_time);
-                       for (client_time_str[0] = i = 0; i < sizeof(client_time); i++) {
+                       for (client_time_str[0] = i = 0; i < TIME_T_SIZE; i++) {
                                char tmp[3];
                                snprintf(tmp, sizeof(tmp), "%02X", (unsigned int)((client_time >> (i * 8)) & 0xFF));
                                strlcat(client_time_str, tmp, sizeof(client_time_str));
                        }
 
-                       server_string_len = Cmd_Argc() + strlen(Cmd_Argv(1)) + DIGEST_SIZE * 2 + 16;
+                       server_string_len = Cmd_Argc() + strlen(Cmd_Argv(1)) + DIGEST_SIZE * 2 + TIME_T_SIZE * 2;
                        for (i = 3; i < Cmd_Argc(); ++i)
                                server_string_len += strlen(Cmd_Argv(i));
                        server_string = (char *) Q_malloc(server_string_len);
@@ -548,7 +548,7 @@
 //Send the rest of the command line over as an unconnected command.
 void CL_Rcon_f (void) {
 
-       char    message[1024], client_time_str[9];
+       char    message[1024], client_time_str[TIME_T_SIZE * 2 + 1];
        int             i, i_from;
        netadr_t        to;
        extern cvar_t   rcon_password, rcon_address, cl_crypt_rcon;
@@ -565,7 +565,7 @@
        if (cl_crypt_rcon.value)
        {
                time(&client_time);
-               for (client_time_str[0] = i = 0; i < sizeof(client_time); i++) {
+               for (client_time_str[0] = i = 0; i < TIME_T_SIZE; i++) {
                        char tmp[3];
                        snprintf(tmp, sizeof(tmp), "%02X", (unsigned int)((client_time >> (i * 8)) & 0xFF));
                        strlcat(client_time_str, tmp, sizeof(client_time_str));
--- sv_main.c.orig
+++ sv_main.c
@@ -1499,7 +1499,7 @@
 
        if ((int)sv_crypt_rcon.value) {
                time(&server_time);
-               for (i = 0; i < sizeof(client_time) * 2; i += 2) {
-                        client_time += ((time_t)char2int((unsigned char)(Cmd_Argv(1) + DIGEST_SIZE * 2)[i]) << (4 + i * 4)) +
-                                       ((time_t)char2int((unsigned char)(Cmd_Argv(1) + DIGEST_SIZE * 2)[i + 1]) << (i * 4));
+               for (i = 0; i < TIME_T_SIZE * 2; i += 2) {
+                        client_time += ((time_t)char2int((unsigned char)(Cmd_Argv(1) + DIGEST_SIZE * 2)[i]) << (4 + i * 4)) +
+                                       ((time_t)char2int((unsigned char)(Cmd_Argv(1) + DIGEST_SIZE * 2)[i + 1]) << (i * 4));
                }
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant