projectswg/pswgcommon
1
0
Fork 0
mirror of https://github.com/ProjectSWGCore/pswgcommon.git synced 2026-01-15 23:04:19 -05:00
Code Issues Projects Releases Wiki Activity

Fixed a couple of image design packets having too few bytes allocated, causing a buffer overflow

Browse Source
This commit is contained in:
Ziggy
2022-09-03 08:08:15 +02:00
parent c751ed57bb
commit d760c06ff4
2 changed files with 24 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
src/main/java/com/projectswg/common/network/packets/swg/zone/object_controller/ImageDesignChangeMessage.kt
View File

@@ -61,7 +61,18 @@ class ImageDesignChangeMessage : ObjectController {
}
override fun encode(): NetBuffer {
val data = NetBuffer.allocate(HEADER_LENGTH + 26)
val booleanBytes = 3
var morphParametersSize = Integer.BYTES
for (morphParameter in morphParameters) {
morphParametersSize += morphParameter.length
}
var indexParametersSize = Integer.BYTES
for (indexParameter in indexParameters) {
indexParametersSize += indexParameter.length
}
val holoemoteLength = 2 + holoemote.length
val hairLength = 2 + hair.length
val data = NetBuffer.allocate(HEADER_LENGTH + Long.SIZE_BYTES * 3 + booleanBytes + Integer.BYTES * 9 + hairLength + hairCustomization.length + morphParametersSize + indexParametersSize + holoemoteLength)
encodeHeader(data)
data.addLong(designerId)
data.addLong(clientId)

13
src/main/java/com/projectswg/common/network/packets/swg/zone/object_controller/ImageDesignEndMessage.kt
View File

@@ -61,7 +61,18 @@ class ImageDesignEndMessage : ObjectController {
}
override fun encode(): NetBuffer {
val data = NetBuffer.allocate(HEADER_LENGTH + 26)
val booleanBytes = 3
var morphParametersSize = Integer.BYTES
for (morphParameter in morphParameters) {
morphParametersSize += morphParameter.length
}
var indexParametersSize = Integer.BYTES
for (indexParameter in indexParameters) {
indexParametersSize += indexParameter.length
}
val holoemoteLength = 2 + holoemote.length
val hairLength = 2 + hair.length
val data = NetBuffer.allocate(HEADER_LENGTH + Long.SIZE_BYTES * 3 + booleanBytes + Integer.BYTES * 9 + hairLength + hairCustomization.length + morphParametersSize + indexParametersSize + holoemoteLength)
encodeHeader(data)
data.addLong(designerId)
data.addLong(clientId)