phaneron/Kelsidavis-WoWee
1
0
Fork 0
mirror of https://github.com/Kelsidavis/WoWee.git synced 2026-05-03 08:03:50 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix(combatlog): validate packed GUID bounds in attacker state parsers

Browse source
This commit is contained in:
Kelsi 2026-03-14 10:48:20 -07:00
parent 98267d6517
commit 43cc2635ac
2 changed files with 17 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

10
src/game/packet_parsers_classic.cpp
View file

@ -489,9 +489,17 @@ bool ClassicPacketParsers::parseAttackerStateUpdate(network::Packet& packet, Att
auto rem = [&]() { return packet.getSize() - packet.getReadPos(); }; auto rem = [&]() { return packet.getSize() - packet.getReadPos(); };
if (rem() < 5) return false; // hitInfo(4) + at least GUID mask byte(1) if (rem() < 5) return false; // hitInfo(4) + at least GUID mask byte(1)
const size_t startPos = packet.getReadPos();
data.hitInfo = packet.readUInt32(); data.hitInfo = packet.readUInt32();
if (!hasFullPackedGuid(packet)) {
packet.setReadPos(startPos);
return false;
}
data.attackerGuid = UpdateObjectParser::readPackedGuid(packet); // PackedGuid in Vanilla data.attackerGuid = UpdateObjectParser::readPackedGuid(packet); // PackedGuid in Vanilla
if (rem() < 1) return false; if (!hasFullPackedGuid(packet)) {
packet.setReadPos(startPos);
return false;
}
data.targetGuid = UpdateObjectParser::readPackedGuid(packet); // PackedGuid in Vanilla data.targetGuid = UpdateObjectParser::readPackedGuid(packet); // PackedGuid in Vanilla
if (rem() < 5) return false; // int32 totalDamage + uint8 subDamageCount if (rem() < 5) return false; // int32 totalDamage + uint8 subDamageCount

8
src/game/world_packets.cpp
View file

@ -3343,7 +3343,15 @@ bool AttackerStateUpdateParser::parse(network::Packet& packet, AttackerStateUpda
size_t startPos = packet.getReadPos(); size_t startPos = packet.getReadPos();
data.hitInfo = packet.readUInt32(); data.hitInfo = packet.readUInt32();
if (!hasFullPackedGuid(packet)) {
packet.setReadPos(startPos);
return false;
}
data.attackerGuid = UpdateObjectParser::readPackedGuid(packet); data.attackerGuid = UpdateObjectParser::readPackedGuid(packet);
if (!hasFullPackedGuid(packet)) {
packet.setReadPos(startPos);
return false;
}
data.targetGuid = UpdateObjectParser::readPackedGuid(packet); data.targetGuid = UpdateObjectParser::readPackedGuid(packet);
// Validate totalDamage + subDamageCount can be read (5 bytes) // Validate totalDamage + subDamageCount can be read (5 bytes)