demostf/parser
1
0
Fork 0
mirror of https://codeberg.org/demostf/parser.git synced 2026-06-03 18:24:05 +02:00
Code Issues Releases Wiki Activity

additional hardening against mallformed demos

Browse source
This commit is contained in:
Robin Appelman 2022-12-13 22:06:07 +01:00
commit a7a46384ce
4 changed files with 45 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

3
src/demo/message/packetentities.rs
View file

@ -297,6 +297,9 @@ impl Parse<'_> for PacketEntitiesMessage {
for _ in 0..updated_entries {
let diff: u32 = read_bit_var(&mut data)?;
last_index = last_index.saturating_add(diff as i32).saturating_add(1);
if last_index >= 2048 {
return Err(ParseError::InvalidDemo("invalid entity index"));
}
let entity_index = EntityId::from(last_index as u32);
let update_type = data.read()?;

2
src/demo/message/stringtable.rs
View file

@ -414,7 +414,7 @@ pub fn parse_string_table_update<'a>(
for _ in 0..entry_count {
let index = if stream.read()? {
(last_entry + 1) as u16
last_entry.saturating_add(1) as u16
} else {
stream.read_sized(entry_bits as usize)?
};

2
src/demo/message/tempentities.rs
View file

@ -54,7 +54,7 @@ impl Parse<'_> for TempEntitiesMessage {
let class_id = if stream.read()? {
let bits = log_base2(state.server_classes.len()) + 1;
(stream.read_sized::<u16>(bits as usize)? - 1).into()
(stream.read_sized::<u16>(bits as usize)?.saturating_sub(1)).into()
} else {
let last = events.last().ok_or(ParseError::InvalidDemo(
"temp entity update without previous",