From 2498318e6e163ef7a092b8a0d5102789f335ae1e Mon Sep 17 00:00:00 2001 From: JuelzIrons Date: Mon, 9 Mar 2026 23:40:18 -0400 Subject: [PATCH] Fix 3 RCEs in packet parsing and texture loading --- Minecraft.Client/AbstractTexturePack.cpp | 5 +-- .../Network/DQRNetworkManager_SendReceive.cpp | 42 ++++++++++++++++--- 2 files changed, 39 insertions(+), 8 deletions(-) diff --git a/Minecraft.Client/AbstractTexturePack.cpp b/Minecraft.Client/AbstractTexturePack.cpp index a3c677272..cd6c497df 100644 --- a/Minecraft.Client/AbstractTexturePack.cpp +++ b/Minecraft.Client/AbstractTexturePack.cpp @@ -296,8 +296,7 @@ void AbstractTexturePack::loadDefaultHTMLColourTable() const DWORD LOCATOR_SIZE = 256; // Use this to allocate space to hold a ResourceLocator string WCHAR szResourceLocator[ LOCATOR_SIZE ]; - // Try and load the HTMLColours.col based off the common XML first, before the deprecated xuiscene_colourtable - wsprintfW(szResourceLocator,L"section://%X,%s#%s",c_ModuleHandle,L"media", L"media/HTMLColours.col"); + swprintf_s(szResourceLocator, LOCATOR_SIZE, L"section://%X,%s#%s",c_ModuleHandle,L"media", L"media/HTMLColours.col"); BYTE *data; UINT dataLength; if(XuiResourceLoadAll(szResourceLocator, &data, &dataLength) == S_OK) @@ -308,7 +307,7 @@ void AbstractTexturePack::loadDefaultHTMLColourTable() } else { - wsprintfW(szResourceLocator,L"section://%X,%s#%s",c_ModuleHandle,L"media", L"media/"); + swprintf_s(szResourceLocator, LOCATOR_SIZE, L"section://%X,%s#%s",c_ModuleHandle,L"media", L"media/"); HXUIOBJ hScene; HRESULT hr = XuiSceneCreate(szResourceLocator,L"xuiscene_colourtable.xur", nullptr, &hScene); diff --git a/Minecraft.Client/Durango/Network/DQRNetworkManager_SendReceive.cpp b/Minecraft.Client/Durango/Network/DQRNetworkManager_SendReceive.cpp index eed3e8511..b8fbe8748 100644 --- a/Minecraft.Client/Durango/Network/DQRNetworkManager_SendReceive.cpp +++ b/Minecraft.Client/Durango/Network/DQRNetworkManager_SendReceive.cpp @@ -209,15 +209,35 @@ void DQRNetworkManager::BytesReceivedInternal(DQRConnectionInfo *connectionInfo, break; case DQRConnectionInfo::ConnectionState_InternalRoomSyncData: connectionInfo->m_pucRoomSyncData[connectionInfo->m_roomSyncDataBytesRead++] = byte; - // The room sync info is sent as a 4 byte count of the length of XUID strings, then the RoomSyncData, then the XUID strings if( connectionInfo->m_roomSyncDataBytesToRead == 0 ) { - // At first stage of reading the 4 byte count if( connectionInfo->m_roomSyncDataBytesRead == 4 ) { - memcpy( &connectionInfo->m_roomSyncDataBytesToRead, connectionInfo->m_pucRoomSyncData, 4); + int receivedSize = 0; + memcpy( &receivedSize, connectionInfo->m_pucRoomSyncData, 4); delete [] connectionInfo->m_pucRoomSyncData; - connectionInfo->m_roomSyncDataBytesToRead += sizeof(RoomSyncData); + + if( receivedSize < 0 || receivedSize > 100000 ) + { + connectionInfo->m_internalDataState = DQRConnectionInfo::ConnectionState_InternalHeaderByte; + connectionInfo->m_pucRoomSyncData = nullptr; + connectionInfo->m_roomSyncDataBytesToRead = 0; + connectionInfo->m_roomSyncDataBytesRead = 0; + break; + } + + int totalSize = receivedSize + sizeof(RoomSyncData); + + if( totalSize < receivedSize ) + { + connectionInfo->m_internalDataState = DQRConnectionInfo::ConnectionState_InternalHeaderByte; + connectionInfo->m_pucRoomSyncData = nullptr; + connectionInfo->m_roomSyncDataBytesToRead = 0; + connectionInfo->m_roomSyncDataBytesRead = 0; + break; + } + + connectionInfo->m_roomSyncDataBytesToRead = totalSize; connectionInfo->m_pucRoomSyncData = new unsigned char[ connectionInfo->m_roomSyncDataBytesToRead ]; connectionInfo->m_roomSyncDataBytesRead = 0; } @@ -296,8 +316,20 @@ void DQRNetworkManager::BytesReceivedInternal(DQRConnectionInfo *connectionInfo, // At first stage of reading the 4 byte count if( connectionInfo->m_addFailedPlayerDataBytesRead == 4 ) { - memcpy( &connectionInfo->m_addFailedPlayerDataBytesToRead, connectionInfo->m_pucAddFailedPlayerData, 4); + int receivedSize = 0; + memcpy( &receivedSize, connectionInfo->m_pucAddFailedPlayerData, 4); delete [] connectionInfo->m_pucAddFailedPlayerData; + + if( receivedSize < 0 || receivedSize > 100000 ) + { + connectionInfo->m_internalDataState = DQRConnectionInfo::ConnectionState_InternalHeaderByte; + connectionInfo->m_pucAddFailedPlayerData = nullptr; + connectionInfo->m_addFailedPlayerDataBytesToRead = 0; + connectionInfo->m_addFailedPlayerDataBytesRead = 0; + break; + } + + connectionInfo->m_addFailedPlayerDataBytesToRead = receivedSize; connectionInfo->m_pucAddFailedPlayerData = new unsigned char[ connectionInfo->m_addFailedPlayerDataBytesToRead ]; connectionInfo->m_addFailedPlayerDataBytesRead = 0; }