Skip to content

Commit fc36efc

Browse files
MaullerSkyaero42
andauthored
bugfix(network): Fix data offset for string reads in NetPacket::readFileMessage() and NetPacket::readFileAnnounceMessage() (#2005)
Co-authored-by: SkyAero <[email protected]>
1 parent 3b7e734 commit fc36efc

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

Core/GameEngine/Source/GameNetwork/NetPacket.cpp

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5809,7 +5809,7 @@ NetCommandMsg * NetPacket::readFileMessage(UnsignedByte *data, Int &i) {
58095809
char filename[_MAX_PATH];
58105810

58115811
// TheSuperHackers @security Mauller/Jbremer/SkyAero 11/12/2025 Prevent buffer overflow when copying filepath string
5812-
i += strlcpy(filename, reinterpret_cast<const char*>(data), ARRAY_SIZE(filename));
5812+
i += strlcpy(filename, reinterpret_cast<const char*>(data + i), ARRAY_SIZE(filename));
58135813
++i; //Increment for null terminator
58145814
msg->setPortableFilename(AsciiString(filename)); // it's transferred as a portable filename
58155815

@@ -5831,7 +5831,7 @@ NetCommandMsg * NetPacket::readFileAnnounceMessage(UnsignedByte *data, Int &i) {
58315831
char filename[_MAX_PATH];
58325832

58335833
// TheSuperHackers @security Mauller/Jbremer/SkyAero 11/12/2025 Prevent buffer overflow when copying filepath string
5834-
i += strlcpy(filename, reinterpret_cast<const char*>(data), ARRAY_SIZE(filename));
5834+
i += strlcpy(filename, reinterpret_cast<const char*>(data + i), ARRAY_SIZE(filename));
58355835
++i; //Increment for null terminator
58365836
msg->setPortableFilename(AsciiString(filename)); // it's transferred as a portable filename
58375837

0 commit comments

Comments
 (0)