forked from electronicarts/CnC_Generals_Zero_Hour
-
Notifications
You must be signed in to change notification settings - Fork 145
Open
Labels
MajorSeverity: Minor < Major < Critical < BlockerSeverity: Minor < Major < Critical < BlockerNetworkAnything related to network, serversAnything related to network, serversSecurityIs security relatedIs security related
Milestone
Description
Unsafe code in Network messages
UnsignedInt dataLength = 0;
memcpy(&dataLength, data + i, sizeof(dataLength)); // safe, but...
i += sizeof(dataLength);
UnsignedByte *buf = NEW UnsignedByte[dataLength]; // CRASH, if sender gives us a dataLength of 2 GB.
memcpy(buf, data + i, dataLength);
i += dataLength;Metadata
Metadata
Assignees
Labels
MajorSeverity: Minor < Major < Critical < BlockerSeverity: Minor < Major < Critical < BlockerNetworkAnything related to network, serversAnything related to network, serversSecurityIs security relatedIs security related