diff options
| author | zakk <zakk@edf5b092-35ff-0310-97b2-ce42778d08ea> | 2005-09-01 02:13:47 +0000 |
|---|---|---|
| committer | zakk <zakk@edf5b092-35ff-0310-97b2-ce42778d08ea> | 2005-09-01 02:13:47 +0000 |
| commit | 3313487e67711e58e6068d134b7efaa0fd3297d2 (patch) | |
| tree | 14f688816ebd466a1418241e6e205507093f4471 /code | |
| parent | 7abb6fea6400c9741b6a208817c7ca17ed4be4fc (diff) | |
| download | ioquake3-aero-3313487e67711e58e6068d134b7efaa0fd3297d2.tar.gz ioquake3-aero-3313487e67711e58e6068d134b7efaa0fd3297d2.zip | |
https://bugzilla.icculus.org/show_bug.cgi?id=2356
Remotely exploitable Infostring Crash
git-svn-id: svn://svn.icculus.org/quake3/trunk@58 edf5b092-35ff-0310-97b2-ce42778d08ea
Diffstat (limited to 'code')
| -rw-r--r-- | code/server/sv_main.c | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/code/server/sv_main.c b/code/server/sv_main.c index fa6a4c8..e83ce19 100644 --- a/code/server/sv_main.c +++ b/code/server/sv_main.c @@ -373,6 +373,15 @@ void SVC_Info( netadr_t from ) { return; } + /* + * Check whether Cmd_Argv(1) has a sane length. This was not done in the original Quake3 version which led + * to the Infostring bug discovered by Luigi Auriemma. See http://aluigi.altervista.org/ for the advisory. + */ + + // A maximum challenge length of 128 should be more than plenty. + if(strlen(Cmd_Argv(1)) > 128) + return; + // don't count privateclients count = 0; for ( i = sv_privateClients->integer ; i < sv_maxclients->integer ; i++ ) { |