Validate staticdata and object property length limits
Some games provide users with enough freedom to create items with metadata longer than 64KB, preventing this from causing issues is on them but we'll still do the minimum not to abort the server if this happens.
This commit is contained in:
parent
eda0178885
commit
d08faa6e5d
@ -83,6 +83,39 @@ std::string ObjectProperties::dump()
|
|||||||
return os.str();
|
return os.str();
|
||||||
}
|
}
|
||||||
|
|
||||||
|
bool ObjectProperties::validate()
|
||||||
|
{
|
||||||
|
const char *func = "ObjectProperties::validate(): ";
|
||||||
|
bool ret = true;
|
||||||
|
|
||||||
|
// cf. where serializeString16 is used below
|
||||||
|
for (u32 i = 0; i < textures.size(); i++) {
|
||||||
|
if (textures[i].size() > U16_MAX) {
|
||||||
|
warningstream << func << "texture " << (i+1) << " has excessive length, "
|
||||||
|
"clearing it." << std::endl;
|
||||||
|
textures[i].clear();
|
||||||
|
ret = false;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
if (nametag.length() > U16_MAX) {
|
||||||
|
warningstream << func << "nametag has excessive length, clearing it." << std::endl;
|
||||||
|
nametag.clear();
|
||||||
|
ret = false;
|
||||||
|
}
|
||||||
|
if (infotext.length() > U16_MAX) {
|
||||||
|
warningstream << func << "infotext has excessive length, clearing it." << std::endl;
|
||||||
|
infotext.clear();
|
||||||
|
ret = false;
|
||||||
|
}
|
||||||
|
if (wield_item.length() > U16_MAX) {
|
||||||
|
warningstream << func << "wield_item has excessive length, clearing it." << std::endl;
|
||||||
|
wield_item.clear();
|
||||||
|
ret = false;
|
||||||
|
}
|
||||||
|
|
||||||
|
return ret;
|
||||||
|
}
|
||||||
|
|
||||||
void ObjectProperties::serialize(std::ostream &os, u16 protocol_version) const
|
void ObjectProperties::serialize(std::ostream &os, u16 protocol_version) const
|
||||||
{
|
{
|
||||||
if (protocol_version > 36)
|
if (protocol_version > 36)
|
||||||
@ -139,7 +172,6 @@ void ObjectProperties::serialize(std::ostream &os, u16 protocol_version) const
|
|||||||
writeU8(os, is_visible);
|
writeU8(os, is_visible);
|
||||||
writeU8(os, makes_footstep_sound);
|
writeU8(os, makes_footstep_sound);
|
||||||
writeF(os, automatic_rotate, protocol_version);
|
writeF(os, automatic_rotate, protocol_version);
|
||||||
// Added in protocol version 14
|
|
||||||
os << serializeString16(mesh);
|
os << serializeString16(mesh);
|
||||||
writeU16(os, colors.size());
|
writeU16(os, colors.size());
|
||||||
for (video::SColor color : colors) {
|
for (video::SColor color : colors) {
|
||||||
|
@ -68,6 +68,8 @@ struct ObjectProperties
|
|||||||
|
|
||||||
ObjectProperties();
|
ObjectProperties();
|
||||||
std::string dump();
|
std::string dump();
|
||||||
|
// check limits of some important properties (strings) that'd cause exceptions later on
|
||||||
|
bool validate();
|
||||||
void serialize(std::ostream &os, u16 protocol_version) const;
|
void serialize(std::ostream &os, u16 protocol_version) const;
|
||||||
void deSerialize(std::istream &is);
|
void deSerialize(std::istream &is);
|
||||||
};
|
};
|
||||||
|
@ -685,6 +685,7 @@ int ObjectRef::l_set_properties(lua_State *L)
|
|||||||
return 0;
|
return 0;
|
||||||
|
|
||||||
read_object_properties(L, 2, sao, prop, getServer(L)->idef());
|
read_object_properties(L, 2, sao, prop, getServer(L)->idef());
|
||||||
|
prop->validate();
|
||||||
sao->notifyObjectPropertiesModified();
|
sao->notifyObjectPropertiesModified();
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
@ -752,6 +753,7 @@ int ObjectRef::l_set_nametag_attributes(lua_State *L)
|
|||||||
std::string nametag = getstringfield_default(L, 2, "text", "");
|
std::string nametag = getstringfield_default(L, 2, "text", "");
|
||||||
prop->nametag = nametag;
|
prop->nametag = nametag;
|
||||||
|
|
||||||
|
prop->validate();
|
||||||
sao->notifyObjectPropertiesModified();
|
sao->notifyObjectPropertiesModified();
|
||||||
lua_pushboolean(L, true);
|
lua_pushboolean(L, true);
|
||||||
return 1;
|
return 1;
|
||||||
|
@ -37,6 +37,7 @@ void StaticObject::serialize(std::ostream &os)
|
|||||||
// data
|
// data
|
||||||
os<<serializeString16(data);
|
os<<serializeString16(data);
|
||||||
}
|
}
|
||||||
|
|
||||||
void StaticObject::deSerialize(std::istream &is, u8 version)
|
void StaticObject::deSerialize(std::istream &is, u8 version)
|
||||||
{
|
{
|
||||||
// type
|
// type
|
||||||
@ -49,6 +50,29 @@ void StaticObject::deSerialize(std::istream &is, u8 version)
|
|||||||
|
|
||||||
void StaticObjectList::serialize(std::ostream &os)
|
void StaticObjectList::serialize(std::ostream &os)
|
||||||
{
|
{
|
||||||
|
// Check for problems first
|
||||||
|
auto problematic = [] (StaticObject &obj) -> bool {
|
||||||
|
if (obj.data.size() > U16_MAX) {
|
||||||
|
errorstream << "StaticObjectList::serialize(): "
|
||||||
|
"object has excessive static data (" << obj.data.size() <<
|
||||||
|
"), deleting it." << std::endl;
|
||||||
|
return true;
|
||||||
|
}
|
||||||
|
return false;
|
||||||
|
};
|
||||||
|
for (auto it = m_stored.begin(); it != m_stored.end(); ) {
|
||||||
|
if (problematic(*it))
|
||||||
|
it = m_stored.erase(it);
|
||||||
|
else
|
||||||
|
it++;
|
||||||
|
}
|
||||||
|
for (auto it = m_active.begin(); it != m_active.end(); ) {
|
||||||
|
if (problematic(it->second))
|
||||||
|
it = m_active.erase(it);
|
||||||
|
else
|
||||||
|
it++;
|
||||||
|
}
|
||||||
|
|
||||||
// version
|
// version
|
||||||
u8 version = 0;
|
u8 version = 0;
|
||||||
writeU8(os, version);
|
writeU8(os, version);
|
||||||
|
Loading…
x
Reference in New Issue
Block a user