polserver / polserver / 35525772954

82%

Build Type

push

github

Committed by web-flow

Commit Message

Refuse a gump reply whose int count wraps the length check (#975)

gumpbutton_handler summed the reply's size as a size_t and stored it in a
32-bit unsigned. Four bytes an int times a count of 0x40000000 is 2^32, so
the stored size came out as the fixed 23 bytes, passed the check against
the packet's length, and the handler then read the string count from four
gigabytes past the packet. Any player with a script gump open could crash
the server with one 23-byte reply.

Both counts are now checked by dividing the room the packet has left,
which cannot wrap, and the running offset is a size_t. The string count
had the same shape, though on a 64-bit build its product did not wrap.

Co-authored-by: murderinc <3738856+murderinc@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Coverage Stats

4 of 4 new or added lines in 1 file covered. (100.0%)

131 existing lines in 3 files now uncovered.

60042 of 73437 relevant lines covered (81.76%)

2313353.43 hits per line