From 46ad4ec4bd802217839d93fc47ae51cdd8c544da Mon Sep 17 00:00:00 2001
From: Randy Heit <rheit@zdoom.fake>
Date: Sun, 2 Jan 2011 18:54:57 +0000
Subject: [PATCH] - Added "special" console command for executing action
 specials. - Fixed buffer overflow attack for DEM_RUNSCRIPT(2).

SVN r3088 (trunk)
---
 src/c_cmds.cpp   | 48 +++++++++++++++++++++++++++++++++++++++++++++++-
 src/d_net.cpp    | 32 +++++++++++++++++++++++++++++++-
 src/d_protocol.h |  1 +
 src/version.h    |  2 +-
 4 files changed, 80 insertions(+), 3 deletions(-)

diff --git a/src/c_cmds.cpp b/src/c_cmds.cpp
index 0831c805f..b3e43f92f 100644
--- a/src/c_cmds.cpp
+++ b/src/c_cmds.cpp
@@ -453,7 +453,7 @@ CCMD (puke)
 
 	if (argc < 2 || argc > 5)
 	{
-		Printf (" puke <script> [arg1] [arg2] [arg3]\n");
+		Printf ("Usage: puke <script> [arg1] [arg2] [arg3]\n");
 	}
 	else
 	{
@@ -489,6 +489,52 @@ CCMD (puke)
 	}
 }
 
+CCMD (special)
+{
+	int argc = argv.argc();
+
+	if (argc < 2 || argc > 7)
+	{
+		Printf("Usage: special <special-name> [arg1] [arg2] [arg3] [arg4] [arg5]\n");
+	}
+	else
+	{
+		int specnum;
+
+		if (argv[1][0] >= '0' && argv[1][0] <= '9')
+		{
+			specnum = atoi(argv[1]);
+			if (specnum < 0 || specnum > 255)
+			{
+				Printf("Bad special number\n");
+				return;
+			}
+		}
+		else
+		{
+			int min_args;
+			specnum = P_FindLineSpecial(argv[1], &min_args);
+			if (specnum == 0 || min_args < 0)
+			{
+				Printf("Unknown special\n");
+				return;
+			}
+			if (argc < 2 + min_args)
+			{
+				Printf("%s needs at least %d argument%s\n", argv[1], min_args, min_args == 1 ? "" : "s");
+				return;
+			}
+		}
+		Net_WriteByte(DEM_RUNSPECIAL);
+		Net_WriteByte(specnum);
+		Net_WriteByte(argc - 2);
+		for (int i = 2; i < argc; ++i)
+		{
+			Net_WriteLong(atoi(argv[i]));
+		}
+	}
+}
+
 CCMD (error)
 {
 	if (argv.argc() > 1)
diff --git a/src/d_net.cpp b/src/d_net.cpp
index e08899719..d13570a33 100644
--- a/src/d_net.cpp
+++ b/src/d_net.cpp
@@ -57,6 +57,7 @@
 #include "g_level.h"
 #include "d_event.h"
 #include "m_argv.h"
+#include "p_lnspec.h"
 
 int P_StartScript (AActor *who, line_t *where, int script, char *map, bool backSide,
 					int arg0, int arg1, int arg2, int always, bool wantResultCode, bool net);
@@ -2316,13 +2317,38 @@ void Net_DoCommand (int type, BYTE **stream, int player)
 			
 			for (i = 0; i < argn; ++i)
 			{
-				arg[i] = ReadLong (stream);
+				int argval = ReadLong(stream);
+				if (i < countof(arg))
+				{
+					arg[i] = argval;
+				}
 			}
 			P_StartScript (players[player].mo, NULL, snum, level.mapname, false,
 				arg[0], arg[1], arg[2], type == DEM_RUNSCRIPT2, false, true);
 		}
 		break;
 
+	case DEM_RUNSPECIAL:
+		{
+			int snum = ReadByte(stream);
+			int argn = ReadByte(stream);
+			int arg[5] = { 0, 0, 0, 0, 0 };
+
+			for (i = 0; i < argn; ++i)
+			{
+				int argval = ReadLong(stream);
+				if (i < countof(arg))
+				{
+					arg[i] = argval;
+				}
+			}
+			if (!CheckCheatmode(player == consoleplayer))
+			{
+				LineSpecials[snum](NULL, players[player].mo, false, arg[0], arg[1], arg[2], arg[3], arg[4]);
+			}
+		}
+		break;
+
 	case DEM_CROUCH:
 		if (gamestate == GS_LEVEL && players[player].mo != NULL && 
 			players[player].health > 0 && !(players[player].oldbuttons & BT_JUMP))
@@ -2521,6 +2547,10 @@ void Net_SkipCommand (int type, BYTE **stream)
 			skip = 3 + *(*stream + 2) * 4;
 			break;
 
+		case DEM_RUNSPECIAL:
+			skip = 2 + *(*stream + 1) * 4;
+			break;
+
 		case DEM_CONVREPLY:
 			skip = 3;
 			break;
diff --git a/src/d_protocol.h b/src/d_protocol.h
index a78c39ae2..b96c94e06 100644
--- a/src/d_protocol.h
+++ b/src/d_protocol.h
@@ -158,6 +158,7 @@ enum EDemoCommand
 	DEM_CONVREPLY,		// 59 Word: Dialogue node, Byte: Reply number
 	DEM_CONVCLOSE,		// 60
 	DEM_CONVNULL,		// 61
+	DEM_RUNSPECIAL,		// 62 Byte: Special number, Byte: Arg count, Ints: Args
 };
 
 // The following are implemented by cht_DoCheat in m_cheat.cpp
diff --git a/src/version.h b/src/version.h
index bc6abfa29..5edcb7108 100644
--- a/src/version.h
+++ b/src/version.h
@@ -64,7 +64,7 @@
 // Protocol version used in demos.
 // Bump it if you change existing DEM_ commands or add new ones.
 // Otherwise, it should be safe to leave it alone.
-#define DEMOGAMEVERSION 0x213
+#define DEMOGAMEVERSION 0x214
 
 // Minimum demo version we can play.
 // Bump it whenever you change or remove existing DEM_ commands.