| 魔兽私服网 发布时间：2008-4-30 16:30:34 |
Index: src/game/AddonMgr.cpp
===================================================================
--- src/game/AddonMgr.cpp (revision 988)
+++ src/game/AddonMgr.cpp (working copy)
@@ -108,15 +108,18 @@
uint32 realsize;
uLongf rsize;
- try
+ if (source->size() < 4)
{
- *source >> realsize;
+ sLog.outDebug("Warning: Incomplete auth session sent.");
+ return;
}
- catch (*yte*uffer::error &)
+ *source >> realsize;
+ if (realsize > 5000)// i'm not sure what is the max size!! ,just set it 5000
{
- sLog.outDebug("Warning: Incomplete auth session sent.");
+ sLog.outError("Warning: Incorrect realsize = %d", realsize);
return;
- }
+ }
+
rsize = realsize;
uint32 position = source->rpos();
@@ -130,6 +133,7 @@
return;
}
int32 result;
+ sLog.outDebug("AddonMgr::SendAddonInfoPacket: realsize = %d, source.size = %d, needsize(position + 5) = %d.",realsize,source->size(),(position + 5));
result = uncompress((uint8*)unpacked.contents(), &rsize, (uint8*)(*source).contents() + position, (*source).size() - position);
if(result != Z_OK)
Index: src/game/MiscHandler.cpp
===================================================================
--- src/game/MiscHandler.cpp (revision 988)
+++ src/game/MiscHandler.cpp (working copy)
@@ -942,6 +942,8 @@
sLog.outDetail("WORLD: Received CMSG_REQUEST_ACCOUNT_DATA");
uint32 id;
+ if (recv_data.size() < 4)
+ return;
recv_data >> id;
if(id > 8)
Index: src/game/WorldSocket.cpp
===================================================================
--- src/game/WorldSocket.cpp (revision 988)
+++ src/game/WorldSocket.cpp (working copy)
@@ -115,17 +115,19 @@
std::string account;
uint32 unk2;
_latency = getMSTime() - _latency;
+ if (recvPacket->size() < 4+4+1+4+20)
+ {
+ sLog.outDebug("Incomplete copy of AUTH_SESSION recieved, recvPacket.size=%d(need>=33).", recvPacket->size());
+ return;
+ }
- try
- {
*recvPacket >> mClient*uild;
*recvPacket >> unk2;
*recvPacket >> account;
*recvPacket >> mClientSeed;
- }
- catch(*yte*uffer::error &)
+ if (recvPacket->size() < 4+4+(account.size()+1)+4+20)
{
- sLog.outDetail("Incomplete copy of AUTH_SESSION recieved.");
+ sLog.outDebug("Recheck size incorrect,incomplete copy of AUTH_SESSION recieved, recvPacket.size=%d(need>=%d).", recvPacket->size(),(4+4+(account.size()+1)+4+20) );
return;
}
@@ -162,8 +164,19 @@
uint32 AccountID;
string GMFlags;
uint32 AccountFlags;
-
+ if (recvData.size() < 4+4+1+1+40)
+ {
+ sLog.outDebug("WorldSocket::InformationRetreiveCallback - Incorrect size of recvData recieved, recvData.size=%d(need>=50).", recvData.size());
+ return;
+ }
+
recvData >> AccountID >> AccountName >> GMFlags >> AccountFlags;
+ if (recvData.size() < 4+4+(AccountName.size()+1)+(GMFlags.size()+1)+40)
+ {
+ sLog.outDebug("WorldSocket::InformationRetreiveCallback - Recheck size incorrect, recvData.size=%d(need>=%d).", recvData.size(),(4+4+(AccountName.size()+1)+(GMFlags.size()+1)+40) );
+ return;
+ }
+
sLog.outDebug( " >> got information packet from logon: `%s` ID %u (request %u)", AccountName.c_str(), AccountID, mRequestID);
// sLog.outColor(TNORMAL, "\n");
Index: src/logonserver/LogonCommServer.cpp
===================================================================
--- src/logonserver/LogonCommServer.cpp (revision 988)
+++ src/logonserver/LogonCommServer.cpp (working copy)
@@ -275,7 +275,11 @@
{
/* this packet is gzipped, whee!  */
uint32 real_size;
+ if (recvData.size() < 4)
+ return;
recvData >> real_size;
+ if (real_size > 5000) // i'm not sure what is the max size!! ,just set it 5000
+ return;
uLongf rsize = real_size;
*yte*uffer buf(real_size); |
|
