Fix invalid message handling to prevent server crashes

godarklight · godarklight · commit 61a8a3ff630e · 2016-02-15T07:36:42.000+10:00
diff --git a/Server/ClientHandler.cs b/Server/ClientHandler.cs
@@ -401,7 +401,7 @@ private static void ReceiveCallback(IAsyncResult ar)
 
                         int messageType = mr.Read<int>();
                         int messageLength = mr.Read<int>();
-                        if (messageType > (Enum.GetNames(typeof(ClientMessageType)).Length - 1))
+                        if (messageType < 0 || messageType > (Enum.GetNames(typeof(ClientMessageType)).Length - 1))
                         {
                             //Malformed message, most likely from a non DMP-client.
                             Messages.ConnectionEnd.SendConnectionEnd(client, "Invalid DMP message. Disconnected.");
@@ -421,7 +421,7 @@ private static void ReceiveCallback(IAsyncResult ar)
                         }
                         else
                         {
-                            if (messageLength < Common.MAX_MESSAGE_SIZE)
+                            if (messageLength > 0 && messageLength < Common.MAX_MESSAGE_SIZE)
                             {
                                 client.isReceivingMessage = true;
                                 client.receiveMessage.data = new byte[messageLength];

Original file line number	Diff line number	Diff line change
`@@ -401,7 +401,7 @@ private static void ReceiveCallback(IAsyncResult ar)`
`401`	`401`
`402`	`402`	`int messageType = mr.Read<int>();`
`403`	`403`	`int messageLength = mr.Read<int>();`
`404`		`- if (messageType > (Enum.GetNames(typeof(ClientMessageType)).Length - 1))`
	`404`	`+ if (messageType < 0 \|\| messageType > (Enum.GetNames(typeof(ClientMessageType)).Length - 1))`
`405`	`405`	`{`
`406`	`406`	`//Malformed message, most likely from a non DMP-client.`
`407`	`407`	`Messages.ConnectionEnd.SendConnectionEnd(client, "Invalid DMP message. Disconnected.");`
`@@ -421,7 +421,7 @@ private static void ReceiveCallback(IAsyncResult ar)`
`421`	`421`	`}`
`422`	`422`	`else`
`423`	`423`	`{`
`424`		`- if (messageLength < Common.MAX_MESSAGE_SIZE)`
	`424`	`+ if (messageLength > 0 && messageLength < Common.MAX_MESSAGE_SIZE)`
`425`	`425`	`{`
`426`	`426`	`client.isReceivingMessage = true;`
`427`	`427`	`client.receiveMessage.data = new byte[messageLength];`