systempolaris

Hopefully this can help some people * Negative lengths can no longer move read/write pointers backwards. - Invalid lengths cannot reach memcpy/memmove. - Reads cannot copy more bytes than the live buffer contains. - Integer addition is checked before computing a new allocation size. - Consumed space at the front is reused before growing the allocation. - Reallocation copies live bytes only, reducing unnecessary copying. - The pool-index loop avoids signed `1 << 31` undefined behaviour. File > libthecore/src/buffer.c Search for : void buffer_realloc(LPBUFFER& buffer, int length); Add this below it: static void buffer_compact(LPBUFFER buffer) { if (!buffer || buffer->read_point == buffer->mem_data) return; if (buffer->length > 0) memmove(buffer->mem_data, buffer->read_point, buffer->length); buffer->read_point = buffer->mem_data; buffer->write_point = buffer->mem_data + buffer->length; buffer->write_point_pos = buffer->length; } Search inside both buffer_get_pool_index and buffer_get_exac_pool_index : for (i = 0; i < 32; ++i) { Replace both with: for (i = 0; i < 31; ++i) { Search for : LPBUFFER buffer_new(int size) Add this at the start of the function: if (size < 0) { return NULL; } Search for : void buffer_write(LPBUFFER& buffer, const void *src, int length) Replace the complete function with: void buffer_write(LPBUFFER& buffer, const void *src, int length) { if (!buffer || !src || length <= 0) { if (length < 0) sys_err("buffer_write: invalid length %d", length); return; } if (buffer->write_point_pos > INT_MAX - length) { sys_err("buffer_write: size overflow (%d + %d)", buffer->write_point_pos, length); return; } if (buffer_has_space(buffer) < length) buffer_compact(buffer); if (buffer_has_space(buffer) < length) { const int required = buffer->write_point_pos + length; const int spare = MIN(10240, length); buffer_realloc(buffer, required <= INT_MAX - spare ? required + spare : required); } thecore_memcpy(buffer->write_point, src, length); buffer_write_proceed(buffer, length); } Search for : void buffer_read(LPBUFFER buffer, void * buf, int bytes) Replace the complete function with: void buffer_read(LPBUFFER buffer, void * buf, int bytes) { if (!buffer || !buf || bytes <= 0) { if (bytes < 0) sys_err("buffer_read: invalid length %d", bytes); return; } if (bytes > buffer->length) { sys_err("buffer_read: requested %d bytes from %d-byte buffer", bytes, buffer->length); return; } thecore_memcpy(buf, buffer->read_point, bytes); buffer_read_proceed(buffer, bytes); } Search for these three complete functions : buffer_byte buffer_word buffer_dword Replace them with : BYTE buffer_byte(LPBUFFER buffer) { if (!buffer || buffer->length < (int)sizeof(BYTE)) return 0; BYTE val = *(BYTE *) buffer->read_point; buffer_read_proceed(buffer, sizeof(BYTE)); return val; } WORD buffer_word(LPBUFFER buffer) { if (!buffer || buffer->length < (int)sizeof(WORD)) return 0; WORD val = *(WORD *) buffer->read_point; buffer_read_proceed(buffer, sizeof(WORD)); return val; } DWORD buffer_dword(LPBUFFER buffer) { if (!buffer || buffer->length < (int)sizeof(DWORD)) return 0; DWORD val = *(DWORD *) buffer->read_point; buffer_read_proceed(buffer, sizeof(DWORD)); return val; } Search for : void buffer_read_proceed(LPBUFFER buffer, int length) Make sure the function starts with: if (length == 0) return; if (length < 0) { sys_err("buffer_proceed: length argument lower than zero (length: %d)", length); return; } else if (length > buffer->length) { sys_err("buffer_proceed: length argument bigger than buffer (length: %d, buffer: %d)", length, buffer->length); length = buffer->length; } Search for : void buffer_write_proceed(LPBUFFER buffer, int length) Replace the complete function with: void buffer_write_proceed(LPBUFFER buffer, int length) { if (!buffer || length < 0 || length > buffer_has_space(buffer)) { sys_err("buffer_write_proceed: invalid length %d (space %d)", length, buffer ? buffer_has_space(buffer) : 0); return; } buffer->length += length; buffer->write_point += length; buffer->write_point_pos += length; } Search for : void buffer_adjust_size(LPBUFFER& buffer, int add_size) Replace the complete function with: void buffer_adjust_size(LPBUFFER& buffer, int add_size) { if (!buffer || add_size <= 0) return; if (buffer_has_space(buffer) < add_size) buffer_compact(buffer); if (buffer_has_space(buffer) >= add_size) return; if (buffer->write_point_pos > INT_MAX - add_size) { sys_err("buffer_adjust_size: size overflow (%d + %d)", buffer->write_point_pos, add_size); return; } sys_log(0, "buffer_adjust %d current %d/%d", add_size, buffer->length, buffer->mem_size); const int required = buffer->write_point_pos + add_size; const int target = buffer->mem_size <= INT_MAX - add_size ? buffer->mem_size + add_size : required; buffer_realloc(buffer, target); } Search for : void buffer_realloc(LPBUFFER& buffer, int length) Replace the complete function definition with: void buffer_realloc(LPBUFFER& buffer, int length) { int i, read_point_pos; LPBUFFER temp; if (!buffer || length < 0) { sys_err("buffer_realloc: invalid length %d", length); return; } if (buffer->mem_size >= length) return; buffer_compact(buffer); i = length - buffer->mem_size; if (i <= 0) return; temp = buffer_new(length); sys_log(0, "reallocating buffer to %d, current %d", temp->mem_size, buffer->mem_size); thecore_memcpy(temp->mem_data, buffer->mem_data, buffer->length); read_point_pos = buffer->read_point - buffer->mem_data; temp->write_point = temp->mem_data + buffer->write_point_pos; temp->write_point_pos = buffer->write_point_pos; temp->read_point = temp->mem_data + read_point_pos; temp->flag = buffer->flag; temp->next = 0; temp->length = buffer->length; buffer_delete(buffer); buffer = temp; } File > EterLib/NetStream.cpp Search for : void CNetworkStream::SetRecvBufferSize(int recvBufSize) void CNetworkStream::ReleaseRecvBuffer() Replace both complete functions with: void CNetworkStream::SetRecvBufferSize(int recvBufSize) { if (recvBufSize <= 0) { ReleaseRecvBuffer(); return; } if (m_recvBuf && m_recvBufSize >= recvBufSize) return; ReleaseRecvBuffer(); m_recvBufSize = recvBufSize; m_recvBuf = new char[m_recvBufSize]; m_recvTEABufSize = ((m_recvBufSize>>3)+1)<<3; m_recvTEABuf = new char[m_recvTEABufSize]; } void CNetworkStream::ReleaseRecvBuffer() { delete [] m_recvBuf; m_recvBuf = NULL; m_recvBufSize = 0; m_recvBufInputPos = 0; m_recvBufOutputPos = 0; delete [] m_recvTEABuf; m_recvTEABuf = NULL; m_recvTEABufSize = 0; m_recvTEABufInputPos = 0; } Search for : void CNetworkStream::SetSendBufferSize(int sendBufSize) Add this at the start of the function: if (sendBufSize <= 0) { delete [] m_sendBuf; m_sendBuf = NULL; m_sendBufSize = 0; m_sendBufInputPos = 0; m_sendBufOutputPos = 0; delete [] m_sendTEABuf; m_sendTEABuf = NULL; m_sendTEABufSize = 0; m_sendTEABufInputPos = 0; return; } Add this after the m_sendBuf and m_sendTEABuf: m_sendBufInputPos = 0; m_sendBufOutputPos = 0; m_sendTEABufInputPos = 0; Search inside CNetworkStream::CNetworkStream : m_sendTEABuf Use this: m_sendTEABuf = NULL; m_sendTEABufSize = 0; m_sendTEABufInputPos = 0; Search for : bool CNetworkStream::Peek(int size) Add this at the start: if (size < 0 || !m_recvBuf) return false; Search for : bool CNetworkStream::Peek(int size, char * pDestBuf) Add this at the start: if (size < 0 || (size > 0 && !pDestBuf)) return false; Search for : bool CNetworkStream::Send(int size, const char * pSrcBuf) Replace the validation with: if (size <= 0 || !pSrcBuf || !m_sendBuf) return false; int sendBufRestSize = m_sendBufSize - m_sendBufInputPos; if (sendBufRestSize <= 1 || size > sendBufRestSize - 1) return false; memcpy(m_sendBuf + m_sendBufInputPos, pSrcBuf, size); m_sendBufInputPos += size; Search for every "if (recvSize < 0)" inside : __RecvInternalBuffer Use this in all three: if (recvSize < 0) { int error = WSAGetLastError(); if (error != WSAEWOULDBLOCK) return false; return true; } else if (recvSize == 0) { return false; } File > UserInterface/PythonNetworkStream.cpp Search for : TDynamicSizePacketHeader DynamicSizePacketHeader; Add this directly after it: if (DynamicSizePacketHeader.size < sizeof(TDynamicSizePacketHeader)) { TraceError("CPythonNetworkStream::CheckPacket - Invalid dynamic packet size: header %d packet size: %u", DynamicSizePacketHeader.header, static_cast<unsigned int>(DynamicSizePacketHeader.size)); ClearRecvBuffer(); PostQuitMessage(0); return false; } File > UserInterface/Packet.h Search for : SPacketGCHybridCryptKeys SPacketGCHybridSDB Use these instead: SPacketGCHybridCryptKeys() : m_pStream(NULL) {} explicit SPacketGCHybridCryptKeys(int iStreamSize) : iKeyStreamLen(iStreamSize), m_pStream(NULL) { if (iStreamSize > 0) m_pStream = new BYTE[iStreamSize]; } SPacketGCHybridSDB() : m_pStream(NULL) {} explicit SPacketGCHybridSDB(int iStreamSize) : iSDBStreamLen(iStreamSize), m_pStream(NULL) { if (iStreamSize > 0) m_pStream = new BYTE[iStreamSize]; } File > UserInterface/PythonNetworkStreamPhaseHandShake.cpp Search for : bool CPythonNetworkStream::RecvHybridCryptKeyPacket() Replace the complete function with: bool CPythonNetworkStream::RecvHybridCryptKeyPacket() { const int iFixedHeaderSize = TPacketGCHybridCryptKeys::GetFixedHeaderSize(); TDynamicSizePacketHeader header; if (!Peek(sizeof(header), &header)) return false; if (header.size < iFixedHeaderSize) { TraceError("RecvHybridCryptKeyPacket: invalid packet size %u", static_cast<unsigned int>(header.size)); return false; } const int iPayloadSize = static_cast<int>(header.size) - iFixedHeaderSize; TPacketGCHybridCryptKeys kPacket(iPayloadSize); if (!Recv(iFixedHeaderSize, &kPacket)) return false; if (kPacket.iKeyStreamLen != iPayloadSize) { TraceError("RecvHybridCryptKeyPacket: stream length %d does not match payload %d", kPacket.iKeyStreamLen, iPayloadSize); return false; } if (!Recv(iPayloadSize, kPacket.m_pStream)) return false; CEterPackManager::Instance().RetrieveHybridCryptPackKeys(kPacket.m_pStream); return true; } Search for : bool CPythonNetworkStream::RecvHybridCryptSDBPacket() Replace the complete function with: bool CPythonNetworkStream::RecvHybridCryptSDBPacket() { const int iFixedHeaderSize = TPacketGCHybridSDB::GetFixedHeaderSize(); TDynamicSizePacketHeader header; if (!Peek(sizeof(header), &header)) return false; if (header.size < iFixedHeaderSize) { TraceError("RecvHybridCryptSDBPacket: invalid packet size %u", static_cast<unsigned int>(header.size)); return false; } const int iPayloadSize = static_cast<int>(header.size) - iFixedHeaderSize; TPacketGCHybridSDB kPacket(iPayloadSize); if (!Recv(iFixedHeaderSize, &kPacket)) return false; if (kPacket.iSDBStreamLen != iPayloadSize) { TraceError("RecvHybridCryptSDBPacket: stream length %d does not match payload %d", kPacket.iSDBStreamLen, iPayloadSize); return false; } if (!Recv(iPayloadSize, kPacket.m_pStream)) return false; CEterPackManager::Instance().RetrieveHybridCryptPackSDB(kPacket.m_pStream); return true; } File > UserInterface/AccountConnector.cpp Search for : bool CAccountConnector::__AuthState_RecvHybridCryptKeys(int iTotalSize) Replace the complete function with: bool CAccountConnector::__AuthState_RecvHybridCryptKeys(int iTotalSize) { const int iFixedHeaderSize = TPacketGCHybridCryptKeys::GetFixedHeaderSize(); if (iTotalSize < iFixedHeaderSize) return false; const int iPayloadSize = iTotalSize - iFixedHeaderSize; TPacketGCHybridCryptKeys kPacket(iPayloadSize); if (!Recv(iFixedHeaderSize, &kPacket)) return false; if (kPacket.iKeyStreamLen != iPayloadSize) return false; if (!Recv(iPayloadSize, kPacket.m_pStream)) return false; CEterPackManager::Instance().RetrieveHybridCryptPackKeys(kPacket.m_pStream); return true; } Search for : bool CAccountConnector::__AuthState_RecvHybridCryptSDB(int iTotalSize) Replace the complete function with: bool CAccountConnector::__AuthState_RecvHybridCryptSDB(int iTotalSize) { const int iFixedHeaderSize = TPacketGCHybridSDB::GetFixedHeaderSize(); if (iTotalSize < iFixedHeaderSize) return false; const int iPayloadSize = iTotalSize - iFixedHeaderSize; TPacketGCHybridSDB kPacket(iPayloadSize); if (!Recv(iFixedHeaderSize, &kPacket)) return false; if (kPacket.iSDBStreamLen != iPayloadSize) return false; if (!Recv(iPayloadSize, kPacket.m_pStream)) return false; CEterPackManager::Instance().RetrieveHybridCryptPackSDB(kPacket.m_pStream); return true; } Search inside CAccountConnector::__AnalyzeVarSizePacket : TDynamicSizePacketHeader dynamicHeader; if (!Peek(sizeof(dynamicHeader), &dynamicHeader)) return true; Add this directly below it: if (dynamicHeader.size < sizeof(dynamicHeader)) return false; File > UserInterface/GuildMarkDownloader.cpp Search for : __LoginState_RecvMarkBlock Add this after the header : if (kPacket.bufSize < sizeof(kPacket) || kPacket.bufSize > INT_MAX) { TraceError("RecvMarkBlock: invalid packet size %u", kPacket.bufSize); return false; } if (!Peek(static_cast<int>(kPacket.bufSize))) return false; Add this before the block loop: DWORD remainingSize = kPacket.bufSize - static_cast<DWORD>(sizeof(kPacket)); Validate each compressed block with: const DWORD blockHeaderSize = sizeof(BYTE) + sizeof(DWORD); if (remainingSize < blockHeaderSize || !Recv(sizeof(BYTE), &posBlock) || !Recv(sizeof(DWORD), &compSize)) return false; remainingSize -= blockHeaderSize; if (compSize > remainingSize || compSize > SGuildMarkBlock::MAX_COMP_SIZE) return false; if (!Recv(static_cast<int>(compSize), compBuf)) return false; remainingSize -= compSize; Add this after the loop: if (remainingSize != 0) return false; Search for : __LoginState_RecvSymbolData Add this before the header: if (packet.size < sizeof(TPacketGCGuildSymbolData)) { TraceError("RecvSymbolData: invalid packet size %u", static_cast<unsigned int>(packet.size)); return false; }