Add upfront validation to group-related parsers

SMSG_PARTY_COMMAND_RESULT improvements:
- Validate 8-byte minimum for command + result + name string
- Graceful handling of truncated result field

SMSG_GROUP_DECLINE improvements:
- Validate 1-byte minimum for playerName CString
- Prevent reading from empty packets

Ensures consistent error handling for group system packets.
This commit is contained in:
Kelsi 2026-03-11 14:38:11 -07:00
parent b699557597
commit 9892d82c52

View file

@ -3579,14 +3579,27 @@ bool GroupListParser::parse(network::Packet& packet, GroupListData& data, bool h
}
bool PartyCommandResultParser::parse(network::Packet& packet, PartyCommandResultData& data) {
// Upfront validation: command(4) + name(var) + result(4) = 8 bytes minimum (plus name string)
if (packet.getSize() - packet.getReadPos() < 8) return false;
data.command = static_cast<PartyCommand>(packet.readUInt32());
data.name = packet.readString();
// Validate result field exists (4 bytes)
if (packet.getSize() - packet.getReadPos() < 4) {
data.result = static_cast<PartyResult>(0);
return true; // Partial read is acceptable
}
data.result = static_cast<PartyResult>(packet.readUInt32());
LOG_DEBUG("Party command result: ", (int)data.result);
return true;
}
bool GroupDeclineResponseParser::parse(network::Packet& packet, GroupDeclineData& data) {
// Upfront validation: playerName is a CString (minimum 1 null terminator)
if (packet.getSize() - packet.getReadPos() < 1) return false;
data.playerName = packet.readString();
LOG_INFO("Group decline from: ", data.playerName);
return true;