Commit graph

27 commits

Author SHA1 Message Date
Robert Müller 3863d41623 Validate snapshot size and member variables and demo snapshots
Add `CSnapshot::IsValid` to check if a snapshot unpacked from a snapshot delta or demo is valid:
- ensure number of items and data size are not negative
- ensure that the actual size of the snapshot matches the size derived from its member variables
- ensure item offsets are within the valid range
- ensure item sizes are not negative

Add `CSnapshot::TotalSize` and `CSnapshot::OffsetSize` utility functions.

Minor improvements to related error messages.

Fixes buffer overflow:

```
==47744==ERROR: AddressSanitizer: global-buffer-overflow on address 0x558618e3767f at pc 0x558614b9bdfb bp 0x7ffe58a32cd0 sp 0x7ffe58a32cc0
READ of size 4 at 0x558618e3767f thread T0
    0x558614b9bdfa in CSnapshotItem::Type() const src/engine/shared/snapshot.h:16
    0x558615c3c911 in CSnapshot::GetItemType(int) const src/engine/shared/snapshot.cpp:29
    0x558614aebaba in CClient::UnpackAndValidateSnapshot(CSnapshot*, CSnapshot*) src/engine/client/client.cpp:2264
    0x558614af87cb in CClient::OnDemoPlayerSnapshot(void*, int) src/engine/client/client.cpp:2598
    0x558615b9db1a in CDemoPlayer::DoTick() src/engine/shared/demo.cpp:659
    0x558615babd3f in CDemoPlayer::Update(bool) src/engine/shared/demo.cpp:1007
    0x558614afb08b in CClient::Update() src/engine/client/client.cpp:2686
    0x558614b1d9eb in CClient::Run() src/engine/client/client.cpp:3296
    0x558614b8e64f in main src/engine/client/client.cpp:4761
```

And fixes a buffer overflow that manifests itself as an internal ASan error:

```
=================================================================
==4755==AddressSanitizer CHECK failed: ../../../../src/libsanitizer/asan/asan_descriptions.cc:79 "((0 && "Address is not in memory and not in shadow?")) != (0)" (0x0, 0x0)
    0x7f0bf5f368be in AsanCheckFailed ../../../../src/libsanitizer/asan/asan_rtl.cc:72
    0x7f0bf5f54eee in __sanitizer::CheckFailed(char const*, int, char const*, unsigned long long, unsigned long long) ../../../../src/libsanitizer/sanitizer_common/sanitizer_termination.cc:77
    0x7f0bf5e4cb6f in GetShadowKind ../../../../src/libsanitizer/asan/asan_descriptions.cc:79
    0x7f0bf5e4cb6f in __asan::GetShadowAddressInformation(unsigned long, __asan::ShadowAddressDescription*) ../../../../src/libsanitizer/asan/asan_descriptions.cc:95
    0x7f0bf5e4cb6f in __asan::GetShadowAddressInformation(unsigned long, __asan::ShadowAddressDescription*) ../../../../src/libsanitizer/asan/asan_descriptions.cc:92
    0x7f0bf5e4e386 in __asan::AddressDescription::AddressDescription(unsigned long, unsigned long, bool) ../../../../src/libsanitizer/asan/asan_descriptions.cc:440
    0x7f0bf5e50e94 in __asan::ErrorGeneric::ErrorGeneric(unsigned int, unsigned long, unsigned long, unsigned long, unsigned long, bool, unsigned long) ../../../../src/libsanitizer/asan/asan_errors.cc:380
    0x7f0bf5f35f4d in __asan::ReportGenericError(unsigned long, unsigned long, unsigned long, unsigned long, bool, unsigned long, unsigned int, bool) ../../../../src/libsanitizer/asan/asan_report.cc:460
    0x7f0bf5e86f5e in __interceptor_memset ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:762
    0x558234873f1d in mem_zero src/base/system.cpp:213
    0x55823481fc27 in CSnapshotBuilder::NewItem(int, int, int) src/engine/shared/snapshot.cpp:675
    0x55823481be65 in CSnapshotDelta::UnpackDelta(CSnapshot*, CSnapshot*, void const*, int) src/engine/shared/snapshot.cpp:380
    0x558234776641 in CDemoPlayer::DoTick() src/engine/shared/demo.cpp:631
    0x5582347861a9 in CDemoPlayer::Update(bool) src/engine/shared/demo.cpp:1007
    0x5582336d4c7d in CClient::Update() src/engine/client/client.cpp:2695
    0x5582336f75dd in CClient::Run() src/engine/client/client.cpp:3305
    0x558233768241 in main src/engine/client/client.cpp:4770
```
2022-07-24 18:00:39 +02:00
Jupeyy 50f8653c57 Minor tweaks to keep ODR across translation units 2022-07-02 14:25:16 +02:00
c0d3d3v 59436b5e6d
Add default values to extended Net Objects 2022-06-27 01:11:19 +02:00
c0d3d3v f819afed6c
Print also extended NetObj and NetMsg Names
Show External NetObjects in Snapshot stats
2022-06-27 01:10:37 +02:00
Robert Müller 31533d5e2a Organize engine-shared includes 2022-05-29 20:02:22 +02:00
Robert Müller 74f87ee604 Remove unnecessary trailing semicolons after method declarations 2022-03-08 20:01:26 +01:00
def bc78ba57b9 Enable readability-inconsistent-declaration-parameter-name 2022-01-22 14:12:59 +01:00
Robert Müller 4dbd8b454d Fix OOB access in CSnapshotDelta::UnpackDelta, cleanup 2022-01-14 19:10:43 +01:00
heinrich5991 b5c09b9c10 Improve performance of SnapFindItem for extended item types
Look up the internal type of the searched-for UUID type once, and then
just do integer comparisons to find the item.

CC #4300
2021-11-07 01:02:20 +01:00
Jupeyy a663799188 uint64 -> uint64_t, int64 -> int64_t 2021-06-24 17:19:17 +02:00
Alexander Akulich 2790270abf Adopt upstream refactoring: Mark several functions as 'const' 2021-02-23 18:26:16 +03:00
heinrich5991 7663641ed2 Fix some variable name's style 2020-11-08 17:15:48 +01:00
Redix d172286c6c Fix out of bounds access in snapshot delta handling 2020-10-11 18:42:06 +02:00
def 346853e817 Signed overflow is undefined in CSnapshot::Crc
src/engine/shared/snapshot.cpp:72:8: runtime error: signed integer overflow: -1297193910 + -1824658838 cannot be represented in type 'int'
    #0 0x565165b0687d in CSnapshot::Crc() /media/ddnet/src/engine/shared/snapshot.cpp:72:8
    #1 0x565165c4d20b in CClient::ProcessServerPacket(CNetChunk*) /media/ddnet/src/engine/client/client.cpp:1981:49
    #2 0x565165c5d960 in CClient::PumpNetwork() /media/ddnet/src/engine/client/client.cpp:2589:6
    #3 0x565165c67a71 in CClient::Update() /media/ddnet/src/engine/client/client.cpp:2856:2
    #4 0x565165c72f4e in CClient::Run() /media/ddnet/src/engine/client/client.cpp:3237:4
    #5 0x565165c94b7e in main /media/ddnet/src/engine/client/client.cpp:4341:11
    #6 0x7fba5af2c151 in __libc_start_main (/usr/lib/libc.so.6+0x28151)
    #7 0x5651659e1e0d in _start (/media/ddnet/DDNet+0x705e0d)
2020-10-11 16:37:03 +02:00
def 3be8a592e5 Run clang-format
Purely automatic change. In case of conflict with this change, apply the
other change and rerun the formatting to restore it:

$ python scripts/fix_style.py
2020-09-26 21:50:15 +02:00
Tim Schumacher 442148a194 Begin work on 0.7 support 2020-06-19 20:27:15 +03:00
Ryozuki 588f8a833f
Fix snapshot storage leak 2020-04-11 13:38:02 +02:00
oy ef3bce204c added some checks to snap handling
(cherry picked from commit a09d498bc9)
2020-01-21 22:16:28 +01:00
Corantin H 761e73a131 should be thread safe now + moved demoedit to a new file 2019-05-31 20:42:28 +02:00
heinrich5991 6ef9c8dbcd First working version of teehistorian
teehistorian records all inputs from the players as well as the player
positions in each tick. It stores this info in a highly compressible
output format (I've achived 5x compression using xz or bz2).
2017-09-20 02:16:11 +02:00
eeeee 2797227063 also remove references to CGameContext from CServer 2017-06-05 22:31:56 -07:00
def 27074e926a Further cleanup 2017-06-02 19:44:14 +02:00
heinrich5991 5ae37e6c72 Add protocol extension with UUIDs
This system can easily be extended by independent authors without
collisions, something the old system with plain increasing integers did
not allow.

Do this by utilizing the previously unused message code `NETMSG_NULL`
which has a value of 0.

This works for engine and game messages, snapshot items and events.
2017-05-25 00:52:43 +02:00
oy 06115dd49d added "Whitespace and line Endings cleanup" by GreYFoX 2011-04-13 20:37:12 +02:00
oy 8cdabb890f fixed that the server crashes on too many snap items (Closes #317), optimised snapshot hashing 2011-01-18 18:09:09 +01:00
Sworddragon fc9211c777 Updated copyrights 2010-11-20 21:26:06 +01:00
Magnus Auvinen 72c06a2589 copied refactor to trunk 2010-05-29 07:25:38 +00:00
Renamed from src/engine/e_snapshot.h (Browse further)