fileRead() can crash the client (Or maybe the server?)

[Einheit-101]

fileRead() in my example resource can crash your game.

To reproduce

1. start my resource
2. type "/c bomb
3. profit

crash.zip

1.5.8-release-20779

[Dutchman101]

Crashes the client (or maybe the server?) > it's a server crash, but when you launch the server using "Host game" and do something (anything) that causes a server crash, the client can crash because the server process is running inside of the client, and subsequently it kills the client due to the exception.

[Dutchman101]

Let me confirm my theory

Dumptraces (to help investigate):

MTA Server.exe crash

CONTEXT:  (.ecxr)
eax=0017f898 ebx=19930520 ecx=00000003 edx=00000000 esi=0017fa6c edi=68e111a4
eip=76fc9242 esp=0017f898 ebp=0017f8f0 iopl=0         nv up ei pl nz ac po nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000212
KERNELBASE!RaiseException+0x62:
76fc9242 8b4c2454        mov     ecx,dword ptr [esp+54h] ss:002b:0017f8ec=082daa81
Resetting default scope

EXCEPTION_RECORD:  (.exr -1)
ExceptionAddress: 76fc9242 (KERNELBASE!RaiseException+0x00000062)
   ExceptionCode: e06d7363 (C++ EH exception)
  ExceptionFlags: 00000001
NumberParameters: 3
   Parameter[0]: 19930520
   Parameter[1]: 0017f930
   Parameter[2]: 68e111a4

PROCESS_NAME:  MTA Server.exe

ERROR_CODE: (NTSTATUS) 0xe06d7363

EXCEPTION_PARAMETER1:  19930520

EXCEPTION_PARAMETER2:  0017f930

EXCEPTION_PARAMETER3:  68e111a4

STACK_TEXT:  
0017f8f0 68d5739a     e06d7363 00000001 00000003 KERNELBASE!RaiseException+0x62
0017f920 68d3cab1     0017f930 68e111a4 68dae0dc deathmatch!_CxxThrowException+0x66
0017f93c 68a36b5a     68dadb20 68a378d2 ffffae9c deathmatch!std::_Xlength_error+0x1f
0017f944 68a378d2     ffffae9c 00010000 0017fa6c deathmatch!std::_Xlen_string+0xa
0017f968 68b49034     ffffae9c 00000000 15c16f0d deathmatch!std::basic_string<char,std::char_traits<char>,std::allocator<char> >::resize+0x172
0017f99c 68c49631     ffffae9c 0017fa6c 15c16c05 deathmatch!CScriptFile::Read+0xb4
0017fa94 694ea1fe     056c3ec8 056c3ec8 053c19d0 deathmatch!CLuaFileDefs::fileRead+0x1e1
0017faac 694fd135     056c3ec8 00000100 00000001 lua5_1!luaD_precall+0x26e
0017fbbc 694e9c7c     056c3ec8 00000001 056c3ec8 lua5_1!luaV_execute+0xff5
0017fbd0 694e1083     056c3ec8 053c1990 ffffffff lua5_1!luaD_call+0x4c
0017fbe4 694ea3a2     056c3ec8 0017fca4 00000000 lua5_1!f_call+0x13
0017fc50 694e9e0a     056c3ec8 694e1070 0017fca4 lua5_1!luaD_rawrunprotected+0x52
0017fc7c 694e1ad3     016c3ec8 694e1070 0017fca4 lua5_1!luaD_pcall+0x3a
0017fcac 68b98a11     056c3ec8 00000002 ffffffff lua5_1!lua_pcall+0x53
0017fccc 68b7cdc6     056c3ec8 00000002 ffffffff deathmatch!CLuaMain::PCall+0x51
0017fd34 68b10d5f     055b46c8 0555ca1c 00000000 deathmatch!CLuaArguments::Call+0xe6
0017fd94 68b1114d     055b46c8 0555ca1c 0555ca04 deathmatch!CRegisteredCommands::CallCommandHandler+0x1ef
0017fdbc 68a626f2     0017fe18 00000000 055d4240 deathmatch!CRegisteredCommands::ProcessCommand+0xdd
0017ffa8 68a93740     056db8f0 055d4240 055d4240 deathmatch!CConsole::HandleInput+0x3a2
0018002c 68a98d9a     056db8e0 15ce96e9 00000000 deathmatch!CGame::ProcessPacket+0x4f0
00180078 68c16bec     0000002a 06189774 061894e8 deathmatch!CGame::StaticProcessPacket+0x1ba
001800dc 68c1590b     02480770 00000049 0242d4f8 deathmatch!CNetServerBuffer::ProcessIncoming+0x1fc
001800f0 68a85fa5     00000000 00180350 0074f070 deathmatch!CNetServerBuffer::DoPulse+0x3b
00180110 68a2c9bb     00180304 00000000 75215f12 deathmatch!CGame::DoPulse+0x235
0018011c 75215f12     00180304 6faaaae0 68f61a00 deathmatch!CServer::DoPulse+0x8b
001801a4 75216e52     0bd3eda5 00000001 00000001 core!CServerImpl::MainLoop+0x92
001802c4 7521e72d     00000001 00742708 00000001 core!CServerImpl::Run+0x8c2
00180a20 00a156c2     00000001 00742708 502f3a43 core!Run+0x3fd
WARNING: Stack unwind information not available. Following frames may be wrong.
0019ff2c 00a159c8     00000001 00742708 00742278 MTA_Server!GetLibMtaVersion+0x6a2
0019ff74 770f6739     002af000 770f6720 0019ffdc MTA_Server!GetLibMtaVersion+0x9a8
0019ff84 77637bed     002af000 0844f6ff 00000000 kernel32!BaseThreadInitThunk+0x19
0019ffdc 77637bbb     00000000 00000000 00000000 ntdll!__RtlUserThreadStart+0x2b
0019ffec 00000000     00a15a3e 002af000 00000000 ntdll!_RtlUserThreadStart+0x1b


SYMBOL_NAME:  kernelbase!RaiseException+62

IMAGE_NAME:  KERNELBASE.dll

FAILURE_BUCKET_ID:  CPP_EXCEPTION_e06d7363_KERNELBASE.dll!RaiseException

"Host game" client crash (same exception)

CONTEXT:  (.ecxr)
eax=2176ec18 ebx=19930520 ecx=00000003 edx=00000000 esi=2176edec edi=665111a4
eip=76fc9242 esp=2176ec18 ebp=2176ec70 iopl=0         nv up ei pl nz ac pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000216
KERNELBASE!RaiseException+0x62:
76fc9242 8b4c2454        mov     ecx,dword ptr [esp+54h] ss:002b:2176ec6c=4e544124
Resetting default scope

EXCEPTION_RECORD:  (.exr -1)
ExceptionAddress: 76fc9242 (KERNELBASE!RaiseException+0x00000062)
   ExceptionCode: e06d7363 (C++ EH exception)
  ExceptionFlags: 00000001
NumberParameters: 3
   Parameter[0]: 19930520
   Parameter[1]: 2176ecb0
   Parameter[2]: 665111a4

PROCESS_NAME:  gta_sa.exe

ERROR_CODE: (NTSTATUS) 0xe06d7363 - <Unable to get error code text>

EXCEPTION_CODE_STR:  e06d7363

EXCEPTION_PARAMETER1:  19930520

EXCEPTION_PARAMETER2:  2176ecb0

EXCEPTION_PARAMETER3:  665111a4

STACK_TEXT:  
2176ec70 6645739a     e06d7363 00000001 00000003 KERNELBASE!RaiseException+0x62
2176eca0 6643cab1     2176ecb0 665111a4 664ae0dc deathmatch!_CxxThrowException+0x66
2176ecbc 66136b5a     664adb20 661378d2 ffffae9c deathmatch!std::_Xlength_error+0x1f
2176ecc4 661378d2     ffffae9c 00010000 2176edec deathmatch!std::_Xlen_string+0xa
2176ece8 66249034     ffffae9c 00000000 5fcdabff deathmatch!std::basic_string<char,std::char_traits<char>,std::allocator<char> >::resize+0x172
2176ed1c 66349631     ffffae9c 2176edec 5fcda8f7 deathmatch!CScriptFile::Read+0xb4
2176ee14 6609a1fe     17066c88 17066c88 2a3afeb8 deathmatch!CLuaFileDefs::fileRead+0x1e1
2176ee2c 660ad135     17066c88 00000100 00000001 lua5_1!luaD_precall+0x26e
2176ef38 66099c7c     17066c88 00000001 17066c88 lua5_1!luaV_execute+0xff5
2176ef4c 66091083     17066c88 2a3afe78 ffffffff lua5_1!luaD_call+0x4c
2176ef60 6609a3a2     17066c88 2176f020 00000000 lua5_1!f_call+0x13
2176efcc 66099e0a     17066c88 66091070 2176f020 lua5_1!luaD_rawrunprotected+0x52
2176eff8 66091ad3     01066c88 66091070 2176f020 lua5_1!luaD_pcall+0x3a
2176f028 66298a11     17066c88 00000002 ffffffff lua5_1!lua_pcall+0x53
2176f048 6627cdc6     17066c88 00000002 ffffffff deathmatch!CLuaMain::PCall+0x51
2176f0b0 66210d5f     2da602a8 2b441ecc 00000000 deathmatch!CLuaArguments::Call+0xe6
2176f110 6621114d     2da602a8 2b441ecc 2b441eb4 deathmatch!CRegisteredCommands::CallCommandHandler+0x1ef
2176f138 661626f2     0076f194 00000000 25b34550 deathmatch!CRegisteredCommands::ProcessCommand+0xdd
2176f324 66193740     2c09b188 25b34550 25b34550 deathmatch!CConsole::HandleInput+0x3a2
2176f3a8 66198d9a     2c09b178 5fcdb517 01334593 deathmatch!CGame::ProcessPacket+0x4f0
2176f3f4 66316bec     0000002a 2d9398f4 2d939a28 deathmatch!CGame::StaticProcessPacket+0x1ba
2176f458 6631590b     17aebb80 00000048 2b1f4318 deathmatch!CNetServerBuffer::ProcessIncoming+0x1fc
2176f46c 66185fa5     00000000 2176f6cc 16c32088 deathmatch!CNetServerBuffer::DoPulse+0x3b
2176f48c 6612c9bb     2176f680 00000000 66855f12 deathmatch!CGame::DoPulse+0x235
2176f498 66855f12     2176f680 6663aae0 666c1a00 deathmatch!CServer::DoPulse+0x8b
2176f520 66856e52     5f25a84c 00000007 00000010 core_66850000!CServerImpl::MainLoop+0x92
2176f640 6685e72d     00000007 2176fdc0 08f60574 core_66850000!CServerImpl::Run+0x8c2
2176fd9c 66bc80e5     00000007 2176fdc0 5dc090b6 core_66850000!Run+0x3fd
2176ff6c 66bc7f3b     2176ff84 770f6739 08f60568 client!CServer::Thread_Run+0x1a5
2176ff74 770f6739     08f60568 770f6720 2176ffdc client!CServer::Thread_EntryPoint+0xb
2176ff84 77637bed     08f60568 4e32eb8f 00000000 kernel32!BaseThreadInitThunk+0x19
2176ffdc 77637bbb     00000000 00000000 00000000 ntdll!__RtlUserThreadStart+0x2b
2176ffec 00000000     66bc7f30 08f60568 00000000 ntdll!_RtlUserThreadStart+0x1b


SYMBOL_NAME:  kernelbase!RaiseException+62

IMAGE_NAME:  KERNELBASE.dll

FAILURE_BUCKET_ID:  CPP_EXCEPTION_e06d7363_KERNELBASE.dll!RaiseException

Crash dialog:

Version = 1.5.8-release-20821.0.000
Time = Wed Feb  3 01:17:52 2021
Module = C:\Program Files (x86)\MTA San Andreas 1.5\server\mods\deathmatch\deathmatch.dll
Code = 0xE06D7363
Offset = 0x004011A4

EAX=2176EC18  EBX=19930520  ECX=00000003  EDX=00000000  ESI=2176EDEC
EDI=665111A4  EBP=2176EC70  ESP=2176EC18  EIP=76FC9242  FLG=00000216
CS=0023   DS=002B  SS=002B  ES=002B   FS=0053  GS=002B

[Einheit-101]

Looks like the crash happens when trying to read in a file position that is lower than zero

[Pirulax]

Yeah, because negative length will underflow the unsigned type, and it will become a very big 64 bit number..

mtasa-blue/Shared/mods/deathmatch/logic/luadefs/CLuaFileDefs.cpp

Line 689 in 7b79541

unsigned long ulCount = 0;

This if course can't handle negative numbers.

According to C documentation fread accepts a size_t (unsigned type), so we should hard error here if the number is negative.