Skip to content

Commit

Permalink
network: Fix crash in ReliablePacketBuffer on mismatching packets
Browse files Browse the repository at this point in the history
In the error condition the exception would be thrown before m_list_size
is decremented, causing a nullptr dereference in e.g. popFirst().
  • Loading branch information
sfan5 committed Aug 15, 2019
1 parent 082066e commit c449116
Showing 1 changed file with 4 additions and 4 deletions.
8 changes: 4 additions & 4 deletions src/network/connection.cpp
Expand Up @@ -322,6 +322,10 @@ void ReliablePacketBuffer::insert(BufferedPacket &p,u16 next_expected)
} }


if (s == seqnum) { if (s == seqnum) {
/* nothing to do this seems to be a resent packet */
/* for paranoia reason data should be compared */
--m_list_size;

if ( if (
(readU16(&(i->data[BASE_HEADER_SIZE+1])) != seqnum) || (readU16(&(i->data[BASE_HEADER_SIZE+1])) != seqnum) ||
(i->data.getSize() != p.data.getSize()) || (i->data.getSize() != p.data.getSize()) ||
Expand All @@ -340,10 +344,6 @@ void ReliablePacketBuffer::insert(BufferedPacket &p,u16 next_expected)
p.address.serializeString().c_str()); p.address.serializeString().c_str());
throw IncomingDataCorruption("duplicated packet isn't same as original one"); throw IncomingDataCorruption("duplicated packet isn't same as original one");
} }

/* nothing to do this seems to be a resent packet */
/* for paranoia reason data should be compared */
--m_list_size;
} }
/* insert or push back */ /* insert or push back */
else if (i != m_list.end()) { else if (i != m_list.end()) {
Expand Down

0 comments on commit c449116

Please sign in to comment.