Skip to content

Commit

Permalink
Fix bad client reliableAcknowledge DOS exploit
Browse files Browse the repository at this point in the history
Having a reliableAcknowledge of 0x7FFFFFFF causes a massive
loop to be executed in SV_UpdateServerCommandsToClient due to the + 1 overflow.
  • Loading branch information
ineed bots authored and timangus committed Apr 19, 2023
1 parent 31c6d2f commit 47c9641
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion code/server/sv_client.c
Original file line number Diff line number Diff line change
Expand Up @@ -1917,7 +1917,7 @@ void SV_ExecuteClientMessage( client_t *cl, msg_t *msg ) {
// NOTE: when the client message is fux0red the acknowledgement numbers
// can be out of range, this could cause the server to send thousands of server
// commands which the server thinks are not yet acknowledged in SV_UpdateServerCommandsToClient
if (cl->reliableAcknowledge < cl->reliableSequence - MAX_RELIABLE_COMMANDS) {
if ((cl->reliableSequence - cl->reliableAcknowledge >= MAX_RELIABLE_COMMANDS) || (cl->reliableSequence - cl->reliableAcknowledge < 0)) {
// usually only hackers create messages like this
// it is more annoying for them to let them hanging
#ifndef NDEBUG
Expand Down

0 comments on commit 47c9641

Please sign in to comment.