From f101fdd426276e18db2c4d4f0e88439a3599b140 Mon Sep 17 00:00:00 2001 From: Mauller <26652186+Mauller@users.noreply.github.com> Date: Thu, 11 Dec 2025 21:30:57 +0000 Subject: [PATCH] bugfix(network): Prevent buffer overflow in NetPacket::readFileMessage() and NetPacket::readFileAnnounceMessage() Co-authored-by: JBremer Co-authored-by: SkyAero --- .../Source/GameNetwork/NetPacket.cpp | 22 +++++-------------- 1 file changed, 6 insertions(+), 16 deletions(-) diff --git a/Core/GameEngine/Source/GameNetwork/NetPacket.cpp b/Core/GameEngine/Source/GameNetwork/NetPacket.cpp index ea92f9c498..8b9590124c 100644 --- a/Core/GameEngine/Source/GameNetwork/NetPacket.cpp +++ b/Core/GameEngine/Source/GameNetwork/NetPacket.cpp @@ -5807,15 +5807,10 @@ NetCommandMsg * NetPacket::readWrapperMessage(UnsignedByte *data, Int &i) { NetCommandMsg * NetPacket::readFileMessage(UnsignedByte *data, Int &i) { NetFileCommandMsg *msg = newInstance(NetFileCommandMsg); char filename[_MAX_PATH]; - char *c = filename; - while (data[i] != 0) { - *c = data[i]; - ++c; - ++i; - } - *c = 0; - ++i; + // TheSuperHackers @security Mauller/Jbremer/SkyAero 11/12/2025 Prevent buffer overflow when copying filepath string + i += strlcpy(filename, reinterpret_cast(data), ARRAY_SIZE(filename)); + ++i; //Increment for null terminator msg->setPortableFilename(AsciiString(filename)); // it's transferred as a portable filename UnsignedInt dataLength = 0; @@ -5834,15 +5829,10 @@ NetCommandMsg * NetPacket::readFileMessage(UnsignedByte *data, Int &i) { NetCommandMsg * NetPacket::readFileAnnounceMessage(UnsignedByte *data, Int &i) { NetFileAnnounceCommandMsg *msg = newInstance(NetFileAnnounceCommandMsg); char filename[_MAX_PATH]; - char *c = filename; - while (data[i] != 0) { - *c = data[i]; - ++c; - ++i; - } - *c = 0; - ++i; + // TheSuperHackers @security Mauller/Jbremer/SkyAero 11/12/2025 Prevent buffer overflow when copying filepath string + i += strlcpy(filename, reinterpret_cast(data), ARRAY_SIZE(filename)); + ++i; //Increment for null terminator msg->setPortableFilename(AsciiString(filename)); // it's transferred as a portable filename UnsignedShort fileID = 0;