phaneron/Kelsidavis-WoWee
1
0
Fork 0
mirror of https://github.com/Kelsidavis/WoWee.git synced 2026-05-03 08:03:50 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Harden GuildQueryResponseParser against truncated packets

Browse source 
Add bounds validation before reading guild name and 10 rank names.
Gracefully handle missing emblem data with safe defaults.
This commit is contained in:
Kelsi 2026-03-11 14:46:44 -07:00
parent 1979aa926b
commit 80c4e77c12
1 changed files with 30 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

33
src/game/world_packets.cpp
View file

@ -2072,15 +2072,42 @@ bool GuildQueryResponseParser::parse(network::Packet& packet, GuildQueryResponse
return false; return false;
} }
data.guildId = packet.readUInt32(); data.guildId = packet.readUInt32();
data.guildName = packet.readString();
for (int i = 0; i < 10; ++i) { // Validate before reading guild name
data.rankNames[i] = packet.readString(); if (packet.getReadPos() >= packet.getSize()) {
LOG_WARNING("GuildQueryResponseParser: truncated before guild name");
data.guildName.clear();
return true;
} }
data.guildName = packet.readString();
// Read 10 rank names with validation
for (int i = 0; i < 10; ++i) {
if (packet.getReadPos() >= packet.getSize()) {
LOG_WARNING("GuildQueryResponseParser: truncated at rank name ", i);
data.rankNames[i].clear();
} else {
data.rankNames[i] = packet.readString();
}
}
// Validate before reading emblem fields (5 uint32s = 20 bytes)
if (packet.getReadPos() + 20 > packet.getSize()) {
LOG_WARNING("GuildQueryResponseParser: truncated before emblem data");
data.emblemStyle = 0;
data.emblemColor = 0;
data.borderStyle = 0;
data.borderColor = 0;
data.backgroundColor = 0;
return true;
}
data.emblemStyle = packet.readUInt32(); data.emblemStyle = packet.readUInt32();
data.emblemColor = packet.readUInt32(); data.emblemColor = packet.readUInt32();
data.borderStyle = packet.readUInt32(); data.borderStyle = packet.readUInt32();
data.borderColor = packet.readUInt32(); data.borderColor = packet.readUInt32();
data.backgroundColor = packet.readUInt32(); data.backgroundColor = packet.readUInt32();
if ((packet.getSize() - packet.getReadPos()) >= 4) { if ((packet.getSize() - packet.getReadPos()) >= 4) {
data.rankCount = packet.readUInt32(); data.rankCount = packet.readUInt32();
} }