Validate string size read from bitstreams in CLuaArgument parsing

Validate max element data name length
multitheftauto · Sep 20, 2018 · 83f0961 · 83f0961
1 parent e843197
commit 83f0961
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 3 deletions.
diff --git a/Server/mods/deathmatch/logic/lua/CLuaArgument.cpp b/Server/mods/deathmatch/logic/lua/CLuaArgument.cpp
@@ -543,8 +543,10 @@ bool CLuaArgument::ReadFromBitStream(NetBitStreamInterface& bitStream, std::vect
             {
                 // Read out the string length
                 unsigned short usLength;
-                if (bitStream.ReadCompressed(usLength) && usLength)
+                if (bitStream.ReadCompressed(usLength) && usLength > 0)
                 {
+                    if (!bitStream.CanReadNumberOfBytes(usLength))
+                        return false;
                     // Allocate a buffer and read the string into it
                     char* szValue = new char[usLength + 1];
                     if (bitStream.Read(szValue, usLength))
@@ -567,8 +569,11 @@ bool CLuaArgument::ReadFromBitStream(NetBitStreamInterface& bitStream, std::vect
             {
                 // Read out the string length
                 uint uiLength;
-                if (bitStream.ReadCompressed(uiLength) && uiLength)
+                if (bitStream.ReadCompressed(uiLength) && uiLength > 0)
                 {
+                    if(!bitStream.CanReadNumberOfBytes(uiLength))
+                        return false;
+
                     bitStream.AlignReadToByteBoundary();
 
                     // Allocate a buffer and read the string into it

diff --git a/Server/mods/deathmatch/logic/packets/CCustomDataPacket.cpp b/Server/mods/deathmatch/logic/packets/CCustomDataPacket.cpp
@@ -25,7 +25,7 @@ CCustomDataPacket::~CCustomDataPacket(void)
 bool CCustomDataPacket::Read(NetBitStreamInterface& BitStream)
 {
     unsigned short usNameLength;
-    if (BitStream.Read(m_ElementID) && BitStream.ReadCompressed(usNameLength) && usNameLength > 0)
+    if (BitStream.Read(m_ElementID) && BitStream.ReadCompressed(usNameLength) && usNameLength > 0 && usNameLength <= MAX_CUSTOMDATA_NAME_LENGTH)
     {
         m_szName = new char[usNameLength + 1];
         if (BitStream.Read(m_szName, usNameLength))