halflife
halflife copied to clipboard
HLTV crashes when an empty clc_stringcmd message is received
A crash will occur if in clc_stringcmd after the message id specify immediately the end of the string (03 00 bytes). But it also works if you send a command that does not have Latin characters, that is, only Unicode is present.
How to reproduce:
- Connect to HLTV server;
- Execute the
cmd тестin the client console; - HLTV server should crash.
Perhaps this bug only works on Windows versions of HLTV.
@shawns-valve
This vulnerability exists in the latest HLTV build - 10185. To fix this bug you should add a check for the absence of an incoming command in BaseClient::ProcessStringCmd and ProxyClient::ProcessStringCmd:
if (!cmdLine.CountToken()) {
m_System->DPrintf("WARNING! BaseClient::ProcessStringCmd: invalid command string.\n");
return false;
}
The solution is taken from ReHLDS commit: https://github.com/dreamstalker/rehlds/pull/838/files