backups/MinecraftConsoles
2
0
Fork 1
mirror of https://github.com/smartcmd/MinecraftConsoles.git synced 2026-08-20 09:57:09 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fix 3 RCEs in packet parsing and texture loading

Browse source
This commit is contained in:
JuelzIrons 2026-03-09 23:40:18 -04:00
parent c998346312
commit 2498318e6e
2 changed files with 39 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
Minecraft.Client/AbstractTexturePack.cpp
View file

@ -296,8 +296,7 @@ void AbstractTexturePack::loadDefaultHTMLColourTable()
const DWORD LOCATOR_SIZE = 256; // Use this to allocate space to hold a ResourceLocator string const DWORD LOCATOR_SIZE = 256; // Use this to allocate space to hold a ResourceLocator string
WCHAR szResourceLocator[ LOCATOR_SIZE ]; WCHAR szResourceLocator[ LOCATOR_SIZE ];
// Try and load the HTMLColours.col based off the common XML first, before the deprecated xuiscene_colourtable swprintf_s(szResourceLocator, LOCATOR_SIZE, L"section://%X,%s#%s",c_ModuleHandle,L"media", L"media/HTMLColours.col");
wsprintfW(szResourceLocator,L"section://%X,%s#%s",c_ModuleHandle,L"media", L"media/HTMLColours.col");
BYTE *data; BYTE *data;
UINT dataLength; UINT dataLength;
if(XuiResourceLoadAll(szResourceLocator, &data, &dataLength) == S_OK) if(XuiResourceLoadAll(szResourceLocator, &data, &dataLength) == S_OK)
@ -308,7 +307,7 @@ void AbstractTexturePack::loadDefaultHTMLColourTable()
} }
else else
{ {
wsprintfW(szResourceLocator,L"section://%X,%s#%s",c_ModuleHandle,L"media", L"media/"); swprintf_s(szResourceLocator, LOCATOR_SIZE, L"section://%X,%s#%s",c_ModuleHandle,L"media", L"media/");
HXUIOBJ hScene; HXUIOBJ hScene;
HRESULT hr = XuiSceneCreate(szResourceLocator,L"xuiscene_colourtable.xur", nullptr, &hScene); HRESULT hr = XuiSceneCreate(szResourceLocator,L"xuiscene_colourtable.xur", nullptr, &hScene);

42
Minecraft.Client/Durango/Network/DQRNetworkManager_SendReceive.cpp
View file

@ -209,15 +209,35 @@ void DQRNetworkManager::BytesReceivedInternal(DQRConnectionInfo *connectionInfo,
break; break;
case DQRConnectionInfo::ConnectionState_InternalRoomSyncData: case DQRConnectionInfo::ConnectionState_InternalRoomSyncData:
connectionInfo->m_pucRoomSyncData[connectionInfo->m_roomSyncDataBytesRead++] = byte; connectionInfo->m_pucRoomSyncData[connectionInfo->m_roomSyncDataBytesRead++] = byte;
// The room sync info is sent as a 4 byte count of the length of XUID strings, then the RoomSyncData, then the XUID strings
if( connectionInfo->m_roomSyncDataBytesToRead == 0 ) if( connectionInfo->m_roomSyncDataBytesToRead == 0 )
{ {
// At first stage of reading the 4 byte count
if( connectionInfo->m_roomSyncDataBytesRead == 4 ) if( connectionInfo->m_roomSyncDataBytesRead == 4 )
{ {
memcpy( &connectionInfo->m_roomSyncDataBytesToRead, connectionInfo->m_pucRoomSyncData, 4); int receivedSize = 0;
memcpy( &receivedSize, connectionInfo->m_pucRoomSyncData, 4);
delete [] connectionInfo->m_pucRoomSyncData; delete [] connectionInfo->m_pucRoomSyncData;
connectionInfo->m_roomSyncDataBytesToRead += sizeof(RoomSyncData);
if( receivedSize < 0 || receivedSize > 100000 )
{
connectionInfo->m_internalDataState = DQRConnectionInfo::ConnectionState_InternalHeaderByte;
connectionInfo->m_pucRoomSyncData = nullptr;
connectionInfo->m_roomSyncDataBytesToRead = 0;
connectionInfo->m_roomSyncDataBytesRead = 0;
break;
}
int totalSize = receivedSize + sizeof(RoomSyncData);
if( totalSize < receivedSize )
{
connectionInfo->m_internalDataState = DQRConnectionInfo::ConnectionState_InternalHeaderByte;
connectionInfo->m_pucRoomSyncData = nullptr;
connectionInfo->m_roomSyncDataBytesToRead = 0;
connectionInfo->m_roomSyncDataBytesRead = 0;
break;
}
connectionInfo->m_roomSyncDataBytesToRead = totalSize;
connectionInfo->m_pucRoomSyncData = new unsigned char[ connectionInfo->m_roomSyncDataBytesToRead ]; connectionInfo->m_pucRoomSyncData = new unsigned char[ connectionInfo->m_roomSyncDataBytesToRead ];
connectionInfo->m_roomSyncDataBytesRead = 0; connectionInfo->m_roomSyncDataBytesRead = 0;
} }
@ -296,8 +316,20 @@ void DQRNetworkManager::BytesReceivedInternal(DQRConnectionInfo *connectionInfo,
// At first stage of reading the 4 byte count // At first stage of reading the 4 byte count
if( connectionInfo->m_addFailedPlayerDataBytesRead == 4 ) if( connectionInfo->m_addFailedPlayerDataBytesRead == 4 )
{ {
memcpy( &connectionInfo->m_addFailedPlayerDataBytesToRead, connectionInfo->m_pucAddFailedPlayerData, 4); int receivedSize = 0;
memcpy( &receivedSize, connectionInfo->m_pucAddFailedPlayerData, 4);
delete [] connectionInfo->m_pucAddFailedPlayerData; delete [] connectionInfo->m_pucAddFailedPlayerData;
if( receivedSize < 0 || receivedSize > 100000 )
{
connectionInfo->m_internalDataState = DQRConnectionInfo::ConnectionState_InternalHeaderByte;
connectionInfo->m_pucAddFailedPlayerData = nullptr;
connectionInfo->m_addFailedPlayerDataBytesToRead = 0;
connectionInfo->m_addFailedPlayerDataBytesRead = 0;
break;
}
connectionInfo->m_addFailedPlayerDataBytesToRead = receivedSize;
connectionInfo->m_pucAddFailedPlayerData = new unsigned char[ connectionInfo->m_addFailedPlayerDataBytesToRead ]; connectionInfo->m_pucAddFailedPlayerData = new unsigned char[ connectionInfo->m_addFailedPlayerDataBytesToRead ];
connectionInfo->m_addFailedPlayerDataBytesRead = 0; connectionInfo->m_addFailedPlayerDataBytesRead = 0;
} }