backups/MinecraftConsoles
2
0
Fork 1
mirror of https://github.com/smartcmd/MinecraftConsoles.git synced 2026-08-20 09:57:09 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

RCE Fix #1

Browse source
This commit is contained in:
x86 2026-03-08 13:02:36 +13:00 committed by GitHub
parent 1be5faaea7
commit 126d08a6f8
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 25 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

29
Minecraft.World/compression.cpp
View file

@ -196,9 +196,20 @@ HRESULT Compression::DecompressLZXRLE(void *pDestination, unsigned int *pDestSiz
unsigned int rleSize = staticRleSize; unsigned int rleSize = staticRleSize;
unsigned char *dynamicRleBuf = NULL; unsigned char *dynamicRleBuf = NULL;
if(*pDestSize > rleSize)
unsigned int safeRleSize = max(rleSize, *pDestSize);
const unsigned int MAX_RLE_ALLOC = 16 * 1024 * 1024; // 16 MB
if(safeRleSize > MAX_RLE_ALLOC)
{ {
rleSize = *pDestSize; LeaveCriticalSection(&rleDecompressLock);
*pDestSize = 0;
return E_FAIL;
}
if(safeRleSize > staticRleSize)
{
rleSize = safeRleSize;
dynamicRleBuf = new unsigned char[rleSize]; dynamicRleBuf = new unsigned char[rleSize];
Decompress(dynamicRleBuf, &rleSize, pSource, SrcSize); Decompress(dynamicRleBuf, &rleSize, pSource, SrcSize);
pucIn = (unsigned char *)dynamicRleBuf; pucIn = (unsigned char *)dynamicRleBuf;
@ -212,16 +223,19 @@ HRESULT Compression::DecompressLZXRLE(void *pDestination, unsigned int *pDestSiz
//unsigned char *pucIn = (unsigned char *)rleDecompressBuf; //unsigned char *pucIn = (unsigned char *)rleDecompressBuf;
unsigned char *pucEnd = pucIn + rleSize; unsigned char *pucEnd = pucIn + rleSize;
unsigned char *pucOut = (unsigned char *)pDestination; unsigned char *pucOut = (unsigned char *)pDestination;
unsigned char *pucOutEnd = pucOut + *pDestSize;
while( pucIn != pucEnd ) while( pucIn != pucEnd )
{ {
unsigned char thisOne = *pucIn++; unsigned char thisOne = *pucIn++;
if( thisOne == 255 ) if( thisOne == 255 )
{ {
if( pucIn >= pucEnd ) break;
unsigned int count = *pucIn++; unsigned int count = *pucIn++;
if( count < 3 ) if( count < 3 )
{ {
count++; count++;
if( pucOut + count > pucOutEnd ) { pucOut = pucOutEnd; break; }
for( unsigned int i = 0; i < count; i++ ) for( unsigned int i = 0; i < count; i++ )
{ {
*pucOut++ = 255; *pucOut++ = 255;
@ -230,7 +244,9 @@ HRESULT Compression::DecompressLZXRLE(void *pDestination, unsigned int *pDestSiz
else else
{ {
count++; count++;
if( pucIn >= pucEnd ) break;
unsigned char data = *pucIn++; unsigned char data = *pucIn++;
if( pucOut + count > pucOutEnd ) { pucOut = pucOutEnd; break; }
for( unsigned int i = 0; i < count; i++ ) for( unsigned int i = 0; i < count; i++ )
{ {
*pucOut++ = data; *pucOut++ = data;
@ -239,6 +255,7 @@ HRESULT Compression::DecompressLZXRLE(void *pDestination, unsigned int *pDestSiz
} }
else else
{ {
if( pucOut >= pucOutEnd ) break;
*pucOut++ = thisOne; *pucOut++ = thisOne;
} }
} }
@ -260,16 +277,19 @@ HRESULT Compression::DecompressRLE(void *pDestination, unsigned int *pDestSize,
unsigned char *pucIn = (unsigned char *)pSource; unsigned char *pucIn = (unsigned char *)pSource;
unsigned char *pucEnd = pucIn + SrcSize; unsigned char *pucEnd = pucIn + SrcSize;
unsigned char *pucOut = (unsigned char *)pDestination; unsigned char *pucOut = (unsigned char *)pDestination;
unsigned char *pucOutEnd = pucOut + *pDestSize;
while( pucIn != pucEnd ) while( pucIn != pucEnd )
{ {
unsigned char thisOne = *pucIn++; unsigned char thisOne = *pucIn++;
if( thisOne == 255 ) if( thisOne == 255 )
{ {
if( pucIn >= pucEnd ) break;
unsigned int count = *pucIn++; unsigned int count = *pucIn++;
if( count < 3 ) if( count < 3 )
{ {
count++; count++;
if( pucOut + count > pucOutEnd ) { pucOut = pucOutEnd; break; }
for( unsigned int i = 0; i < count; i++ ) for( unsigned int i = 0; i < count; i++ )
{ {
*pucOut++ = 255; *pucOut++ = 255;
@ -278,7 +298,9 @@ HRESULT Compression::DecompressRLE(void *pDestination, unsigned int *pDestSize,
else else
{ {
count++; count++;
if( pucIn >= pucEnd ) break;
unsigned char data = *pucIn++; unsigned char data = *pucIn++;
if( pucOut + count > pucOutEnd ) { pucOut = pucOutEnd; break; }
for( unsigned int i = 0; i < count; i++ ) for( unsigned int i = 0; i < count; i++ )
{ {
*pucOut++ = data; *pucOut++ = data;
@ -287,6 +309,7 @@ HRESULT Compression::DecompressRLE(void *pDestination, unsigned int *pDestSize,
} }
else else
{ {
if( pucOut >= pucOutEnd ) break;
*pucOut++ = thisOne; *pucOut++ = thisOne;
} }
} }
@ -542,5 +565,3 @@ void Compression::SetDecompressionType(ESavePlatform platform)
} }
/*Compression gCompression;*/ /*Compression gCompression;*/