Mirrors/overte-JulianGro
3
0
Fork 0
mirror of https://github.com/JulianGro/overte.git synced 2025-05-04 20:32:41 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge pull request #1180 from ZappoMan/bugfixes

Browse source 
add guards against buffer overflow in voxel server for edit/delete voxel packets
This commit is contained in:
Stephen Birarda 2013-11-05 11:49:06 -08:00
commit de5496aedc
2 changed files with 28 additions and 18 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

32
libraries/voxel-server-library/src/VoxelServerPacketProcessor.cpp
View file

@ -49,25 +49,31 @@ void VoxelServerPacketProcessor::processPacket(sockaddr& senderAddress, unsigned
int atByte = numBytesPacketHeader + sizeof(itemNumber); int atByte = numBytesPacketHeader + sizeof(itemNumber);
unsigned char* voxelData = (unsigned char*)&packetData[atByte]; unsigned char* voxelData = (unsigned char*)&packetData[atByte];
while (atByte < packetLength) { while (atByte < packetLength) {
unsigned char octets = (unsigned char)*voxelData; unsigned char octets = numberOfThreeBitSectionsInCode(voxelData);
const int COLOR_SIZE_IN_BYTES = 3; const int COLOR_SIZE_IN_BYTES = 3;
int voxelDataSize = bytesRequiredForCodeLength(octets) + COLOR_SIZE_IN_BYTES; int voxelDataSize = bytesRequiredForCodeLength(octets) + COLOR_SIZE_IN_BYTES;
int voxelCodeSize = bytesRequiredForCodeLength(octets); int voxelCodeSize = bytesRequiredForCodeLength(octets);
if (_myServer->wantShowAnimationDebug()) { if (atByte + voxelDataSize <= packetLength) {
int red = voxelData[voxelCodeSize + 0]; if (_myServer->wantShowAnimationDebug()) {
int green = voxelData[voxelCodeSize + 1]; int red = voxelData[voxelCodeSize + RED_INDEX];
int blue = voxelData[voxelCodeSize + 2]; int green = voxelData[voxelCodeSize + GREEN_INDEX];
int blue = voxelData[voxelCodeSize + BLUE_INDEX];
float* vertices = firstVertexForCode(voxelData); float* vertices = firstVertexForCode(voxelData);
printf("inserting voxel: %f,%f,%f r=%d,g=%d,b=%d\n", vertices[0], vertices[1], vertices[2], red, green, blue); printf("inserting voxel: %f,%f,%f r=%d,g=%d,b=%d\n", vertices[0], vertices[1], vertices[2], red, green, blue);
delete[] vertices; delete[] vertices;
} }
_myServer->getServerTree().readCodeColorBufferToTree(voxelData, destructive); _myServer->getServerTree().readCodeColorBufferToTree(voxelData, destructive);
// skip to next
voxelData += voxelDataSize; // skip to next voxel edit record in the packet
atByte += voxelDataSize; voxelData += voxelDataSize;
atByte += voxelDataSize;
} else {
printf("WARNING! Got voxel edit record that would overflow buffer, bailing processing of packet!\n");
break;
}
} }
// Make sure our Node and NodeList knows we've heard from this node. // Make sure our Node and NodeList knows we've heard from this node.

14
libraries/voxels/src/VoxelTree.cpp
View file

@ -583,11 +583,15 @@ void VoxelTree::processRemoveVoxelBitstream(unsigned char * bitstream, int buffe
while (atByte < bufferSizeBytes) { while (atByte < bufferSizeBytes) {
int codeLength = numberOfThreeBitSectionsInCode(voxelCode); int codeLength = numberOfThreeBitSectionsInCode(voxelCode);
int voxelDataSize = bytesRequiredForCodeLength(codeLength) + SIZE_OF_COLOR_DATA; int voxelDataSize = bytesRequiredForCodeLength(codeLength) + SIZE_OF_COLOR_DATA;
deleteVoxelCodeFromTree(voxelCode, COLLAPSE_EMPTY_TREE); if (atByte + voxelDataSize <= bufferSizeBytes) {
deleteVoxelCodeFromTree(voxelCode, COLLAPSE_EMPTY_TREE);
voxelCode+=voxelDataSize; voxelCode += voxelDataSize;
atByte+=voxelDataSize; atByte += voxelDataSize;
} else {
printf("WARNING! Got remove voxel bitstream that would overflow buffer, bailing processing!\n");
break;
}
} }
} }