Mirrored_Repos/DarkflameServer
1
0
Fork 0
mirror of https://github.com/DarkflameUniverse/DarkflameServer.git synced 2026-10-07 13:23:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: bound AMF3 decoding and stop hashing client keys

Browse Source 
Client-sent AMF (CONTROL_BEHAVIORS) was decoded without limits on the
associative part of arrays, on nesting depth, or on the total number of
values. Associative entries went into an unordered_map with the standard
unseeded string hash, so a client could pick colliding keys and make
insertion quadratic, and deeply nested arrays recursed until the stack
overflowed, crashing the world server.

- The associative map is now an ordered std::map (O(log n) whatever the
  keys, deterministic serialization order).
- Each array allows at most 10,000 associative entries, the same as the
  existing dense limit, which is now checked before anything is read.
- Arrays may nest at most 32 deep and one deserializer reads at most
  100,000 values. Every limit throws, which the only caller already
  catches and drops the message.
- Inserting a duplicate key keeps the last value and no longer returns a
  reference to a value that was destroyed when the key already held null.

Verified with new unit tests for each limit (including a 100,000 deep
nesting that previously overflowed the stack) and the existing live
packet test, which still decodes.

Fixes #2035

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Aaron Kimbrell
2026-09-26 18:41:58 -05:00
parent 2d1ef0e370
commit 7a433ee950
4 changed files with 194 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
dCommon/AMFDeserialize.cpp
View File

@@ -11,6 +11,13 @@
*/
std::unique_ptr<AMFBaseValue> AMFDeserialize::Read(RakNet::BitStream& inStream) {
// Every value counts against the budget for this deserializer, so one message
// cannot make the server build an unbounded tree of values.
if (++m_ValuesRead > MaxValues) {
LOG("AMF value budget of %u exceeded, possible spoof, aborting deserialize.", MaxValues);
throw std::invalid_argument("AMF value budget exceeded");
}
// Read in the value type from the bitStream
eAmf marker;
inStream.Read(marker);
@@ -112,27 +119,41 @@ std::unique_ptr<AMFDoubleValue> AMFDeserialize::ReadAmfDouble(RakNet::BitStream&
}
std::unique_ptr<AMFArrayValue> AMFDeserialize::ReadAmfArray(RakNet::BitStream& inStream) {
// Arrays are the only values that nest, so bound the recursion here.
if (m_Depth >= MaxDepth) {
LOG("AMF arrays nested deeper than %u, possible spoof, aborting deserialize.", MaxDepth);
throw std::invalid_argument("AMF arrays nested too deeply");
}
++m_Depth;
auto arrayValue = std::make_unique<AMFArrayValue>();
// Read size of dense array
const auto sizeOfDenseArray = (ReadU29(inStream) >> 1);
if (sizeOfDenseArray > MaxArraySize) {
LOG("Someone sent %u dense array entries, probably a bad packet.", sizeOfDenseArray);
throw std::invalid_argument("Too many dense AMF array entries");
}
// Then read associative portion
uint32_t associativeEntries = 0;
while (true) {
const auto key = ReadString(inStream);
// No more associative values when we encounter an empty string key
if (key.size() == 0) break;
if (++associativeEntries > MaxArraySize) {
LOG("Someone sent more than %u associative array entries, probably a bad packet.", MaxArraySize);
throw std::invalid_argument("Too many associative AMF array entries");
}
arrayValue->Insert(key, Read(inStream));
}
constexpr int32_t maxArraySize = 10'000;
if (sizeOfDenseArray > maxArraySize) {
LOG("Someone sent 10,000 dense array entries, probably a bad packet.");
throw std::invalid_argument("Someone sent 10,000 dense array entries, probably a bad packet.");
}
// Finally read dense portion
for (uint32_t i = 0; i < sizeOfDenseArray; i++) {
arrayValue->Insert(i, Read(inStream));
}
--m_Depth;
return arrayValue;
}