godotengine/godot
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
497bc7d5fd
godot/core
History
Fabio Alessandrelli 497bc7d5fd Fix marshalls size checks. 
Yesterday, when playing around with my network code, I realized there is
a security issue in decode_variant, at least when decoding PoolArrays.
Basically, the size of the PoolArray is encoded in a uint32_t, when
decoding it, that value is cast to int when comparing if the packet is
actually that size causing numbers with MSB=1 to be interpreted as
negative thus always passing the check. That same value though, is used
as uint32_t again to resize the output vector.  For this reason, sending
a malformed packet with declared type PoolByteArray and size of 2^31(+x)
causes the engine to try to allocate 2+GB of pool memory, causing the
engine to crash.

This patch is a backport of the one initially written for the master
branch.
2018-07-28 17:17:36 +02:00
..
bind Merge pull request #15565 from RandomShaper/adpod-topmost-2.1 2018-02-14 16:43:20 +01:00
helper Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
io Fix marshalls size checks. 2018-07-28 17:17:36 +02:00
math Style: Format code with clang-format 6.0.1 2018-07-18 17:56:12 +02:00
os Style: Format code with clang-format 6.0.1 2018-07-18 17:56:12 +02:00
allocators.h Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
array.cpp Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
array.h Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
color_names.inc Add missing map.h include in color defs 2017-03-19 00:32:58 +01:00
color.cpp Fix crash when deallocating named colors map 2018-07-18 11:36:43 +03:00
color.h Fix crash when deallocating named colors map 2018-07-18 11:36:43 +03:00
command_queue_mt.cpp Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
command_queue_mt.h Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
compressed_translation.cpp Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
compressed_translation.h Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
core_string_names.cpp Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
core_string_names.h Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
dictionary.cpp Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
dictionary.h Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
dvector.cpp Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
dvector.h Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
error_list.h Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
error_macros.cpp Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
error_macros.h Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
event_queue.cpp Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
event_queue.h Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
func_ref.cpp Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
func_ref.h Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
global_constants.cpp Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
global_constants.h Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
globals.cpp Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
globals.h Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
hash_map.h Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
hashfuncs.h Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
image_quantize.cpp Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
image.cpp Fix more -Wc++11-narrowing errors with clang 2018-04-03 13:09:53 +02:00
image.h Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
input_map.cpp Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
input_map.h Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
int_types.h Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
list.h Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
make_binders.py style: Fix PEP8 blank lines issues in Python files 2016-11-02 22:29:36 +01:00
map.h Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
message_queue.cpp Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
message_queue.h Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
method_bind.cpp Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
method_bind.h Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
method_ptrcall.h Bring that Whole New World to the Old Continent too 2017-03-19 00:36:26 +01:00
object_type_db.cpp Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
object_type_db.h Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
object.cpp Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
object.h Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
packed_data_container.cpp Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
packed_data_container.h Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
pair.h Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
path_db.cpp Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
path_db.h Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
path_remap.cpp Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
path_remap.h Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
pool_allocator.cpp Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
pool_allocator.h Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
print_string.cpp Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
print_string.h Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
ref_ptr.cpp Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
ref_ptr.h Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
reference.cpp Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
reference.h Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
register_core_types.cpp Style: Format code with clang-format 6.0.1 2018-07-18 17:56:12 +02:00
register_core_types.h Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
resource.cpp Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
resource.h Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
rid.cpp Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
rid.h Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
ring_buffer.h Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
safe_refcount.cpp Change "env['ndk_platform']" to "ndk_platform" and add "can_vectorize = True" 2018-04-26 09:29:28 -04:00
safe_refcount.h Change "env['ndk_platform']" to "ndk_platform" and add "can_vectorize = True" 2018-04-26 09:29:28 -04:00
script_debugger_local.cpp Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
script_debugger_local.h Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
script_debugger_remote.cpp return integer for set_output_buffer_max_size() & set_input_buffer_max_size(int) 2018-05-15 19:11:23 +07:00
script_debugger_remote.h Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
script_language.cpp Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
script_language.h Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
SCsub add NoCache wrapper to Command 2018-06-21 03:40:24 -04:00
self_list.h Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
set.h Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
simple_type.h Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
sort.h Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
string_db.cpp Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
string_db.h Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
translation.cpp Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
translation.h Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
typedefs.h Style: Format code with clang-format 6.0.1 2018-07-18 17:56:12 +02:00
ucaps.h Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
undo_redo.cpp Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
undo_redo.h Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
ustring.cpp Last -Wc++11-narrowing fix for clang 6.0 2018-04-03 15:59:57 +02:00
ustring.h Add encrypt_text/decrypt_text function using aes256 algorithm 2018-03-20 10:38:51 -04:00
variant_call.cpp Add encrypt_text/decrypt_text function using aes256 algorithm 2018-03-20 10:38:51 -04:00
variant_construct_string.cpp Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
variant_op.cpp Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
variant_parser.cpp Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
variant_parser.h Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
variant.cpp Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
variant.h Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
vector.h Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
version.h Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
vmap.h Update copyright statements to 2018 2018-01-02 11:27:24 +01:00
vset.h Update copyright statements to 2018 2018-01-02 11:27:24 +01:00