1
0
mirror of https://github.com/godotengine/godot.git synced 2025-11-07 12:30:27 +00:00
Files
godot/core
Fabio Alessandrelli feaf03421d Fix marshalls size checks.
Yesterday, when playing around with my network code, I realized there is
a security issue in decode_variant, at least when decoding PoolArrays.
Basically, the size of the PoolArray is encoded in a uint32_t, when
decoding it, that value is cast to int when comparing if the packet is
actually that size causing numbers with MSB=1 to be interpreted as
negative thus always passing the check. That same value though, is used
as uint32_t again to resize the output vector.  For this reason, sending
a malformed packet with declared type PoolByteArray and size of 2^31(+x)
causes the engine to try to allocate 2+GB of pool memory, causing the
engine to crash.

(cherry picked from commit 5262d1bbcc)
2018-07-29 03:00:34 +02:00
..
2018-07-21 09:09:42 -03:00
2018-07-29 03:00:34 +02:00
2018-07-25 15:34:24 -05:00
2018-07-25 15:34:24 -05:00
2018-02-21 19:46:06 +01:00
2018-07-24 12:13:05 +02:00
2018-07-24 12:13:05 +02:00
2018-02-21 19:46:06 +01:00
2018-06-25 16:22:41 -03:00
2018-06-25 16:22:41 -03:00