ioquake/jedi-academy
0
0
Fork 0
mirror of https://github.com/ioquake/jedi-academy.git synced 2024-11-25 21:51:04 +00:00
Code Issues Projects Releases Packages Wiki Activity

CVE-2005-0430 Remotely exploitable Infostring Crash

Browse source 
CVE-2005-0430
The Quake 3 engine, as used in multiple game packages, allows remote
attackers to cause a denial of service (shutdown game server) and
possibly crash the server via a long infostring, possibly triggering a
buffer overflow.

Luigi Auriemma q3infoboom
bugzilla #2356

from Thilo Schulz in ioquake3
svn 58 git 01da6d757bb3121c9ee077e7269eee7655abd05b

https://bugzilla.icculus.org/show_bug.cgi?id=2356
Remotely exploitable Infostring Crash
This commit is contained in:
Jonathan Gray 2013-05-07 01:15:46 +10:00
parent 6902b84f94
commit a6591f68df
1 changed files with 9 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
codemp/server/sv_main.cpp
View file

@ -401,6 +401,15 @@ void SVC_Info( netadr_t from ) {
return; return;
} }
/*
* Check whether Cmd_Argv(1) has a sane length. This was not done in the original Quake3 version which led
* to the Infostring bug discovered by Luigi Auriemma. See http://aluigi.altervista.org/ for the advisory.
*/
// A maximum challenge length of 128 should be more than plenty.
if(strlen(Cmd_Argv(1)) > 128)
return;
// don't count privateclients // don't count privateclients
count = 0; count = 0;
for ( i = sv_privateClients->integer ; i < sv_maxclients->integer ; i++ ) { for ( i = sv_privateClients->integer ; i < sv_maxclients->integer ; i++ ) {