From 61564fee09be2f8a008effd7e3ddd9befe3381da Mon Sep 17 00:00:00 2001 From: Acts1631 Date: Tue, 4 Aug 2026 15:31:11 -0400 Subject: [PATCH] Validate special ping packets before decoding The receive loop accepted a five-byte ping prefix, then read a timestamp and a counted peer list without checking their lengths. Reject packets shorter than the fixed header or the advertised peer records before decoding them. --- src/network/stk_host.cpp | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/src/network/stk_host.cpp b/src/network/stk_host.cpp index 9be2f9938d0..5ac0a2f7a7f 100644 --- a/src/network/stk_host.cpp +++ b/src/network/stk_host.cpp @@ -1127,12 +1127,27 @@ void STKHost::mainLoop(ProcessType pt) { if (!is_server) { + const size_t header_size = g_ping_packet.size() + + sizeof(uint64_t) + sizeof(uint8_t); + if (event.packet->dataLength < header_size) + { + Log::warn("STKHost", "Invalid ping packet size."); + enet_packet_destroy(event.packet); + continue; + } BareNetworkString ping_packet((char*)event.packet->data, (int)event.packet->dataLength); std::map peer_pings; ping_packet.skip((int)g_ping_packet.size()); uint64_t server_time = ping_packet.getUInt64(); unsigned peer_size = ping_packet.getUInt8(); + if (ping_packet.size() < peer_size * + (sizeof(uint32_t) * 2)) + { + Log::warn("STKHost", "Invalid ping peer list."); + enet_packet_destroy(event.packet); + continue; + } for (unsigned i = 0; i < peer_size; i++) { unsigned host_id = ping_packet.getUInt32();