zdoom/raze-gles
0
0
Fork 0
mirror of https://github.com/ZDoom/raze-gles.git synced 2024-11-11 07:11:39 +00:00
Code Issues Projects Releases Packages Wiki Activity

net: correct packet buffer overflow checks.

Browse source 
The GAMESTATE one has to be carried out twice, first on the data from
xd3_encode_memory, and then with the compressed data (because it might have
increased in size, though this is very unlikely).  The MOVE check is
similar, though there, failure of the first check implies corrupt memory
(which is why we're Bassert'ing that condition).

Currently, the overflow on GAMESTATE sending happens when switching to a
different map.

git-svn-id: https://svn.eduke32.com/eduke32@2735 1a8010ca-5511-0410-912e-c29ae57300e0
This commit is contained in:
helixhorned 2012-06-03 19:20:36 +00:00
parent 8ffb35add0
commit 18eba11657
1 changed files with 11 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
polymer/eduke32/source/net.c
View file

@ -1750,7 +1750,6 @@ void Net_StreamLevel(void)
streamoutput = (netmapstate_t *)Bcalloc(1, sizeof(netmapstate_t));
for (pi=0; pi<(signed)g_netServer->peerCount; pi++)
{
ENetPeer *const currentPeer = &g_netServer->peers[pi];
const intptr_t playeridx = (intptr_t)currentPeer->data;
@ -1772,15 +1771,23 @@ void Net_StreamLevel(void)
g_netMapRevision++;
{
char buf[PACKBUF_SIZE+512];
char buf[PACKBUF_SIZE+400];
if (siz >= PACKBUF_SIZE)
if (osize >= PACKBUF_SIZE)
{
initprintf("Global packet buffer overflow! Size of packet: %i\n", siz);
// XXX: this currently happens when e.g. switching levels
initprintf("Packet buffer overflow! Size of packet after diff before compress: %u\n", osize);
return;
}
siz = qlz_compress((char *)streamoutput, buf, osize, state_compress);
if (siz >= PACKBUF_SIZE-1)
{
initprintf("Global packet buffer overflow! Size of packet after diff and compress: %d\n", siz);
return;
}
Bmemcpy(packbuf+1, buf, siz);
siz++;
}