edg-l/ddnet
1
0
Fork 0
mirror of https://github.com/ddnet/ddnet.git synced 2024-11-18 22:18:19 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix the same token being generated for each client

Browse source 
Theoretically, a regression test would be nice here, but we don't really
have the infrastructure…

This fixes a spoofing vulnerability.
This commit is contained in:
heinrich5991 2020-08-10 22:38:49 +02:00
parent 3fde3ac496
commit 2db4e2a3c8
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
src/engine/shared/network_server.cpp
View file

@ -147,7 +147,7 @@ SECURITY_TOKEN CNetServer::GetToken(const NETADDR &Addr)
SHA256_CTX Sha256;
sha256_init(&Sha256);
sha256_update(&Sha256, (unsigned char*)m_SecurityTokenSeed, sizeof(m_SecurityTokenSeed));
sha256_update(&Sha256, (unsigned char*)&Addr, sizeof(20)); //omit port, bad idea?
sha256_update(&Sha256, (unsigned char*)&Addr, 20); // omit port, bad idea!
SECURITY_TOKEN SecurityToken = ToSecurityToken(sha256_finish(&Sha256).data);