From f31673ac856b310fab661da8a0d5497b32e598ee Mon Sep 17 00:00:00 2001 From: Acts1631 Date: Wed, 16 Sep 2026 19:42:23 -0400 Subject: [PATCH 1/3] Bound kart entries to peer profiles --- src/network/protocols/server_lobby.cpp | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/network/protocols/server_lobby.cpp b/src/network/protocols/server_lobby.cpp index 50f7befde6a..903ce63c69d 100644 --- a/src/network/protocols/server_lobby.cpp +++ b/src/network/protocols/server_lobby.cpp @@ -4170,6 +4170,12 @@ void ServerLobby::addLiveJoinPlaceholder( void ServerLobby::setPlayerKarts(const NetworkString& ns, STKPeer* peer) const { unsigned player_count = ns.getUInt8(); + if (player_count > peer->getPlayerProfiles().size()) + { + Log::warn("ServerLobby", "Too many kart entries from %s.", + peer->getAddress().toString().c_str()); + return; + } for (unsigned i = 0; i < player_count; i++) { std::string kart; From de9ca98ead3eb34ebb4f1b6f1da57b539d5904ce Mon Sep 17 00:00:00 2001 From: Acts1631 Date: Thu, 17 Sep 2026 16:37:39 -0400 Subject: [PATCH 2/3] Propagate malformed kart-list rejection Make setPlayerKarts report an invalid player count so live-join handling does not continue with unset kart data. Return the peer to the lobby when a malformed request is rejected. --- src/network/protocols/server_lobby.cpp | 18 +++++++++++++----- src/network/protocols/server_lobby.hpp | 2 +- 2 files changed, 14 insertions(+), 6 deletions(-) diff --git a/src/network/protocols/server_lobby.cpp b/src/network/protocols/server_lobby.cpp index 903ce63c69d..da5201de4be 100644 --- a/src/network/protocols/server_lobby.cpp +++ b/src/network/protocols/server_lobby.cpp @@ -1247,7 +1247,13 @@ void ServerLobby::liveJoinRequest(Event* event) if (!spectator) { auto spectators_by_limit = getSpectatorsByLimit(); - setPlayerKarts(data, peer); + if (!setPlayerKarts(data, peer)) + { + // The kart list is part of the live-join request. Do not continue + // with uninitialised kart data after rejecting a malformed list. + rejectLiveJoin(peer, BLR_NONE); + return; + } std::vector used_id; for (unsigned i = 0; i < peer->getPlayerProfiles().size(); i++) @@ -3166,7 +3172,8 @@ void ServerLobby::kartSelectionRequested(Event* event) const NetworkString& data = event->data(); STKPeer* peer = event->getPeer(); - setPlayerKarts(data, peer); + if (!setPlayerKarts(data, peer)) + return; } // kartSelectionRequested //----------------------------------------------------------------------------- @@ -4167,14 +4174,14 @@ void ServerLobby::addLiveJoinPlaceholder( } // addLiveJoinPlaceholder //----------------------------------------------------------------------------- -void ServerLobby::setPlayerKarts(const NetworkString& ns, STKPeer* peer) const +bool ServerLobby::setPlayerKarts(const NetworkString& ns, STKPeer* peer) const { unsigned player_count = ns.getUInt8(); if (player_count > peer->getPlayerProfiles().size()) { Log::warn("ServerLobby", "Too many kart entries from %s.", peer->getAddress().toString().c_str()); - return; + return false; } for (unsigned i = 0; i < player_count; i++) { @@ -4198,7 +4205,7 @@ void ServerLobby::setPlayerKarts(const NetworkString& ns, STKPeer* peer) const } if (peer->getClientCapabilities().find("real_addon_karts") == peer->getClientCapabilities().end() || ns.size() == 0) - return; + return true; for (unsigned i = 0; i < player_count; i++) { KartData kart_data(ns); @@ -4225,6 +4232,7 @@ void ServerLobby::setPlayerKarts(const NetworkString& ns, STKPeer* peer) const player->setKartData(kart_data); } } + return true; } // setPlayerKarts //----------------------------------------------------------------------------- diff --git a/src/network/protocols/server_lobby.hpp b/src/network/protocols/server_lobby.hpp index bbb6ed8ad59..f838fb0f56c 100644 --- a/src/network/protocols/server_lobby.hpp +++ b/src/network/protocols/server_lobby.hpp @@ -270,7 +270,7 @@ class ServerLobby : public LobbyProtocol void encodePlayers(BareNetworkString* bns, std::vector >& players) const; std::vector > getLivePlayers() const; - void setPlayerKarts(const NetworkString& ns, STKPeer* peer) const; + bool setPlayerKarts(const NetworkString& ns, STKPeer* peer) const; bool handleAssets(const NetworkString& ns, STKPeer* peer); void liveJoinRequest(Event* event); void rejectLiveJoin(STKPeer* peer, BackLobbyReason blr); From 4638ea17ed0bf340851e5873c0030e73722b5b17 Mon Sep 17 00:00:00 2001 From: Acts1631 Date: Mon, 21 Sep 2026 16:03:56 -0400 Subject: [PATCH 3/3] Remove redundant kart selection check --- src/network/protocols/server_lobby.cpp | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/src/network/protocols/server_lobby.cpp b/src/network/protocols/server_lobby.cpp index da5201de4be..5d854bfec5e 100644 --- a/src/network/protocols/server_lobby.cpp +++ b/src/network/protocols/server_lobby.cpp @@ -3172,8 +3172,7 @@ void ServerLobby::kartSelectionRequested(Event* event) const NetworkString& data = event->data(); STKPeer* peer = event->getPeer(); - if (!setPlayerKarts(data, peer)) - return; + setPlayerKarts(data, peer); } // kartSelectionRequested //-----------------------------------------------------------------------------