diff options
author | Mike Frysinger <vapier@gentoo.org> | 2005-07-14 02:24:00 +0000 |
---|---|---|
committer | Mike Frysinger <vapier@gentoo.org> | 2005-07-14 02:24:00 +0000 |
commit | 6c353d582fde1c6afc988d9e7735d0cc7c9126c7 (patch) | |
tree | aa73b2b429df15cd2a1cf82d2eaef6f84a2fa2c6 /games-strategy/netpanzer | |
parent | fix building with newer flex (diff) | |
download | gentoo-2-6c353d582fde1c6afc988d9e7735d0cc7c9126c7.tar.gz gentoo-2-6c353d582fde1c6afc988d9e7735d0cc7c9126c7.tar.bz2 gentoo-2-6c353d582fde1c6afc988d9e7735d0cc7c9126c7.zip |
Fix DoS in server #98922 by Stefan Cornelius.
(Portage version: 2.0.51.22-r1)
Diffstat (limited to 'games-strategy/netpanzer')
5 files changed, 316 insertions, 1 deletions
diff --git a/games-strategy/netpanzer/ChangeLog b/games-strategy/netpanzer/ChangeLog index e2164b07b8cc..b0f81c77d120 100644 --- a/games-strategy/netpanzer/ChangeLog +++ b/games-strategy/netpanzer/ChangeLog @@ -1,6 +1,13 @@ # ChangeLog for games-strategy/netpanzer # Copyright 2000-2005 Gentoo Foundation; Distributed under the GPL v2 -# $Header: /var/cvsroot/gentoo-x86/games-strategy/netpanzer/ChangeLog,v 1.18 2005/07/01 17:50:00 fmccor Exp $ +# $Header: /var/cvsroot/gentoo-x86/games-strategy/netpanzer/ChangeLog,v 1.19 2005/07/14 02:24:00 vapier Exp $ + +*netpanzer-0.8-r1 (14 Jul 2005) + + 14 Jul 2005; Mike Frysinger <vapier@gentoo.org> + +files/netpanzer-0.8-min-size-check.patch, + +files/netpanzer-0.8-robust.patch, +netpanzer-0.8-r1.ebuild: + Fix DoS in server #98922 by Stefan Cornelius. 01 Jul 2005; Ferris McCormick <fmccor@gentoo.org> netpanzer-0.8.ebuild: Add ~sparc keyword --- Users report success running it, and it does build diff --git a/games-strategy/netpanzer/files/digest-netpanzer-0.8-r1 b/games-strategy/netpanzer/files/digest-netpanzer-0.8-r1 new file mode 100644 index 000000000000..1f7f2a2367ef --- /dev/null +++ b/games-strategy/netpanzer/files/digest-netpanzer-0.8-r1 @@ -0,0 +1,2 @@ +MD5 c08c1b703eac533407db02510deca68e netpanzer-0.8.tar.bz2 382007 +MD5 d2dbd5a6c38a181fa3b6aa9a68c81d2f netpanzer-data-0.8.tar.bz2 10123751 diff --git a/games-strategy/netpanzer/files/netpanzer-0.8-min-size-check.patch b/games-strategy/netpanzer/files/netpanzer-0.8-min-size-check.patch new file mode 100644 index 000000000000..dc97ffcf4a7c --- /dev/null +++ b/games-strategy/netpanzer/files/netpanzer-0.8-min-size-check.patch @@ -0,0 +1,33 @@ +The size needs to be at least 2 or the code gets hung up. + +http://bugs.gentoo.org/98922 + +--- src/NetPanzer/Network/ServerSocket.cpp ++++ src/NetPanzer/Network/ServerSocket.cpp +@@ -169,7 +169,7 @@ + + size = htol16(*((int16_t*) tempbuffer)); + +- if ( (size < 0) || (size > _MAX_NET_PACKET_SIZE) ) { ++ if ( (size < 2) || (size > _MAX_NET_PACKET_SIZE) ) { + LOG( ("OnReadStreamServer : Invalid Packet Size %d", size) ); + recvoffset = 0; + client->headerincomplete = false; +@@ -224,7 +224,7 @@ + + size = htol16(*((int16_t*) tempbuffer)); + +- if ( (size < 0) || (size > _MAX_NET_PACKET_SIZE) ) { ++ if ( (size < 2) || (size > _MAX_NET_PACKET_SIZE) ) { + LOG( ("OnReadStreamServer : Invalid Packet Size %d", size) ); + recvoffset = 0; + client->messageincomplete = false; +@@ -266,7 +266,7 @@ + } else if (recvsize >= 2) { + size = htol16(*((int16_t*) (recvbuffer + recvoffset))); + +- if( (size < 0) || (size > _MAX_NET_PACKET_SIZE) ) { ++ if( (size < 2) || (size > _MAX_NET_PACKET_SIZE) ) { + LOG( ("OnReadStreamServer : Invalid Packet Size %d", size) ); + recvoffset = 0; + client->tempoffset = 0; diff --git a/games-strategy/netpanzer/files/netpanzer-0.8-robust.patch b/games-strategy/netpanzer/files/netpanzer-0.8-robust.patch new file mode 100644 index 000000000000..d0e138e7f687 --- /dev/null +++ b/games-strategy/netpanzer/files/netpanzer-0.8-robust.patch @@ -0,0 +1,205 @@ +A few more sanity checks from upstream svn. + +Index: src/NetPanzer/Interfaces/ChatInterface.cpp +=================================================================== +--- src/NetPanzer/Interfaces/ChatInterface.cpp (revision 928) ++++ src/NetPanzer/Interfaces/ChatInterface.cpp (revision 929) +@@ -39,9 +39,16 @@ + ChatMesg chat_mesg; + const ChatMesgRequest* chat_request = (const ChatMesgRequest*) message; + ++ if(chat_request->getSourcePlayerIndex() >= PlayerInterface::getMaxPlayers()) ++ { ++ LOGGER.warning("Invalid chatMessageRequest"); ++ return; ++ } ++ + chat_mesg.setSourcePlayerIndex(chat_request->getSourcePlayerIndex()); + chat_mesg.message_scope = chat_request->message_scope; +- strcpy( chat_mesg.message_text, chat_request->message_text ); ++ snprintf(chat_mesg.message_text, sizeof(chat_mesg.message_text), "%s", ++ chat_request->message_text); + + if( chat_request->message_scope == _chat_mesg_scope_all ) { + SERVER->sendMessage(&chat_mesg, sizeof(ChatMesg)); +@@ -126,6 +133,11 @@ + unsigned short local_player_index; + const ChatMesg *chat_mesg = (const ChatMesg*) message; + ++ if(chat_mesg->getSourcePlayerIndex() >= PlayerInterface::getMaxPlayers()) { ++ LOGGER.warning("malformed chatmessage packet."); ++ return; ++ } ++ + if( chat_mesg->message_scope == _chat_mesg_scope_server ) { + ConsoleInterface::postMessage("Server: %s", chat_mesg->message_text ); + return; +Index: src/NetPanzer/Interfaces/GameManager.cpp +=================================================================== +--- src/NetPanzer/Interfaces/GameManager.cpp (revision 928) ++++ src/NetPanzer/Interfaces/GameManager.cpp (revision 929) +@@ -411,6 +411,11 @@ + = (const SystemConnectAlert*) message; + PlayerState *player_state = 0; + ++ if(connect_alert->getPlayerID() >= PlayerInterface::getMaxPlayers()) { ++ LOGGER.warning("Malformed connect alert message."); ++ return; ++ } ++ + player_state = PlayerInterface::getPlayerState( connect_alert->getPlayerID() ); + + switch (connect_alert->alert_enum) { +@@ -471,6 +476,11 @@ + const SystemPingRequest *ping_request + = (const SystemPingRequest*) message; + ++ if(ping_request->getClientPlayerIndex() >= PlayerInterface::getMaxPlayers()) { ++ LOGGER.warning("Invalid pingRequest message"); ++ return; ++ } ++ + player_id = PlayerInterface::getPlayerID( ping_request->getClientPlayerIndex() ); + + SystemPingAcknowledge ping_ack; +Index: src/NetPanzer/Interfaces/PlayerInterface.cpp +=================================================================== +--- src/NetPanzer/Interfaces/PlayerInterface.cpp (revision 928) ++++ src/NetPanzer/Interfaces/PlayerInterface.cpp (revision 929) +@@ -25,6 +25,7 @@ + #include "PlayerNetMessage.hpp" + #include "Server.hpp" + #include "NetworkServer.hpp" ++#include "Util/Log.hpp" + + #include "ConsoleInterface.hpp" + // for UNIT_FLAGS_SURFACE +@@ -410,6 +411,10 @@ + = (const PlayerConnectID *) message; + + local_player_index = connect_mesg->connect_state.getPlayerIndex(); ++ if(local_player_index >= max_players) { ++ LOGGER.warning("Invalide netMessageConnectID Message"); ++ return; ++ } + + SDL_mutexP(mutex); + player_lists[local_player_index].setFromNetworkPlayerState +@@ -423,6 +428,12 @@ + const PlayerStateSync *sync_mesg + = (const PlayerStateSync *) message; + uint16_t player_index = sync_mesg->player_state.getPlayerIndex(); ++ ++ if(player_index >= max_players) { ++ LOGGER.warning("Malformed MessageSyncState message"); ++ return; ++ } ++ + SDL_mutexP(mutex); + player_lists[player_index].setFromNetworkPlayerState(&sync_mesg->player_state); + forceUniquePlayerFlags(); +@@ -475,6 +486,14 @@ + const PlayerScoreUpdate* score_update + = (const PlayerScoreUpdate *) message; + ++ if(score_update->getKillByPlayerIndex() >= PlayerInterface::getMaxPlayers() ++ || score_update->getKillOnPlayerIndex() ++ >= PlayerInterface::getMaxPlayers()) ++ { ++ LOGGER.warning("Malformed scrore update packet."); ++ return; ++ } ++ + PlayerState* player1 = getPlayer(score_update->getKillByPlayerIndex()); + PlayerState* player2 = getPlayer(score_update->getKillOnPlayerIndex()); + setKill(player1, player2, (UnitType) score_update->unit_type ); +@@ -487,6 +506,12 @@ + const PlayerAllianceRequest *allie_request + = (const PlayerAllianceRequest *) message; + ++ if(allie_request->getAllieByPlayerIndex() >= max_players ++ || allie_request->getAllieWithPlayerIndex() >= max_players) { ++ LOGGER.warning("Invalid alliance request message"); ++ return; ++ } ++ + SDL_mutexP(mutex); + if ( allie_request->alliance_request_type == _player_make_alliance ) { + setAlliance( +@@ -541,6 +566,12 @@ + const PlayerAllianceUpdate* allie_update + = (const PlayerAllianceUpdate *) message; + ++ if(allie_update->getAllieByPlayerIndex() >= max_players ++ || allie_update->getAllieWithPlayerIndex() >= max_players) { ++ LOGGER.warning("Invalid alliance update message"); ++ return; ++ } ++ + SDL_mutexP(mutex); + if (allie_update->alliance_update_type == _player_make_alliance) { + setAlliance( +Index: src/NetPanzer/Interfaces/InfoThread.cpp +=================================================================== +--- src/NetPanzer/Interfaces/InfoThread.cpp (revision 928) ++++ src/NetPanzer/Interfaces/InfoThread.cpp (revision 929) +@@ -174,15 +174,20 @@ + InfoThread::sendPlayers(std::stringstream& out) + { + ObjectiveInterface::updatePlayerObjectiveCounts(); +- for(int i = 0; i < PlayerInterface::countPlayers(); ++i) { ++ int n = 0; ++ for(int i = 0; i < PlayerInterface::getMaxPlayers(); ++i) { + PlayerState* playerState = PlayerInterface::getPlayerState(i); +- out << "player_" << i << "\\" << playerState->getName() << "\\" +- << "kills_" << i << "\\" << playerState->getKills() << "\\" +- << "deaths_" << i << "\\" << playerState->getLosses() << "\\" +- << "score_" << i << "\\" ++ if(playerState->getStatus() != _player_state_active) ++ continue; ++ ++ out << "player_" << n << "\\" << playerState->getName() << "\\" ++ << "kills_" << n << "\\" << playerState->getKills() << "\\" ++ << "deaths_" << n << "\\" << playerState->getLosses() << "\\" ++ << "score_" << n << "\\" + << playerState->getObjectivesHeld() << "\\" +- << "flag_" << i << "\\" ++ << "flag_" << n << "\\" + << (int) playerState->getFlag() << "\\"; ++ n++; + } + // TODO add team/alliance info + } +Index: src/NetPanzer/Classes/Network/NetMessageDecoder.cpp +=================================================================== +--- src/NetPanzer/Classes/Network/NetMessageDecoder.cpp (revision 928) ++++ src/NetPanzer/Classes/Network/NetMessageDecoder.cpp (revision 929) +@@ -57,6 +57,12 @@ + return false; + + *message = (NetMessage *) (decode_message.data + decode_message_index); ++ if( (*message)->getSize() > ++ decode_message.getSize() - decode_message.getHeaderSize() - ++ decode_message_index) { ++ LOGGER.warning("Malformed Multimessage!"); ++ return false; ++ } + decode_message_index += (*message)->getSize(); + decode_current_count++; + +Index: src/NetPanzer/Classes/Objective.cpp +=================================================================== +--- src/NetPanzer/Classes/Objective.cpp (revision 928) ++++ src/NetPanzer/Classes/Objective.cpp (revision 929) +@@ -69,6 +69,11 @@ + { + const SyncObjective *sync_mesg = (const SyncObjective*) message; + ++ if(sync_mesg->getOccupyingPlayerID() >= PlayerInterface::getMaxPlayers()) { ++ LOGGER.warning("Malformed ObjectvieMesgSync"); ++ return; ++ } ++ + objective_state.objective_status = sync_mesg->objective_status; + objective_state.occupation_status = sync_mesg->occupation_status; + if(objective_state.occupation_status != _occupation_status_unoccupied) { diff --git a/games-strategy/netpanzer/netpanzer-0.8-r1.ebuild b/games-strategy/netpanzer/netpanzer-0.8-r1.ebuild new file mode 100644 index 000000000000..a8a716d21e68 --- /dev/null +++ b/games-strategy/netpanzer/netpanzer-0.8-r1.ebuild @@ -0,0 +1,68 @@ +# Copyright 1999-2005 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Header: /var/cvsroot/gentoo-x86/games-strategy/netpanzer/netpanzer-0.8-r1.ebuild,v 1.1 2005/07/14 02:24:00 vapier Exp $ + +inherit eutils games + +DATAVERSION="0.8" +DESCRIPTION="Fast-action multiplayer strategic network game" +HOMEPAGE="http://netpanzer.berlios.de/" +SRC_URI="http://download.berlios.de/netpanzer/netpanzer-${PV}.tar.bz2 + http://download.berlios.de/netpanzer/netpanzer-data-${DATAVERSION}.tar.bz2" + +LICENSE="GPL-2" +SLOT="0" +KEYWORDS="~amd64 ppc ~sparc x86" +IUSE="dedicated" + +RDEPEND="dedicated? ( app-misc/screen ) + >=media-libs/libsdl-1.2.5 + >=media-libs/sdl-mixer-1.2.4 + >=media-libs/sdl-image-1.2.3 + >=dev-games/physfs-0.1.9" +DEPEND="${RDEPEND} + >=dev-util/jam-2.5" + +src_unpack() { + unpack ${A} + cd "${S}" +# epatch "${FILESDIR}"/${P}-min-size-check.patch +# epatch "${FILESDIR}"/${P}-robust.patch +} + +src_compile() { + egamesconf || die + jam -q || die "jam failed" + + einfo "Working in ${WORKDIR}/${PN}-data-${DATAVERSION}/" + cd "${WORKDIR}"/${PN}-data-${DATAVERSION} + egamesconf || die + jam -q || die "jam failed (on data package)" +} + +src_install() { + jam -sDESTDIR="${D}" -sappdocdir=/usr/share/doc/${PF} install || die "jam install failed" + + cd "${WORKDIR}"/${PN}-data-${DATAVERSION}/ + jam -sDESTDIR="${D}" -sappdocdir=/usr/share/doc/${PF} install || die "jam install failed (data package)" + + if use dedicated ; then + newinitd "${FILESDIR}/netpanzer.rc" netpanzer || die "newinitd failed" + sed -i \ + -e "s:GAMES_USER_DED:${GAMES_USER_DED}:" \ + -e "s:GENTOO_DIR:${GAMES_BINDIR}:" \ + "${D}/etc/init.d/netpanzer" \ + || die "sed failed" + + insinto /etc + doins "${FILESDIR}/netpanzer-ded.ini" || die "doins failed" + exeinto "${GAMES_BINDIR}" + doexe "${FILESDIR}/netpanzer-ded" || die "doexe failed" + sed -i \ + -e "s:GENTOO_DIR:${GAMES_BINDIR}:" \ + "${D}${GAMES_BINDIR}/netpanzer-ded" \ + || die "sed failed" + fi + make_desktop_entry netpanzer NetPanzer netpanzer.png + prepgamesdirs +} |