jeirmeister/Cockatrice
1
0
Fork 0
mirror of https://github.com/Cockatrice/Cockatrice.git synced 2026-09-21 09:05:10 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

[Server] Fix unauthenticated crash via replay submit code (#7072)

Browse source 
cmdReplaySubmitCode dereferenced userInfo without an authentication
guard, allowing an unauthenticated connection with a valid replay code
to segfault the server. Add the same authState != PasswordRight guard
used by all other replay handlers, and gate session command dispatch on
a pre-auth whitelist so future handlers cannot be reached before login.

Took 2 minutes

Co-authored-by: Lukas Brübach <Bruebach.Lukas@bdosecurity.de>
This commit is contained in:
BruebachL 2026-08-14 08:56:54 +02:00 • committed by GitHub
parent 7971ebfe94
commit d93f63050c
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 52 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

4
servatrice/src/serversocketinterface.cpp
View file

@ -896,6 +896,10 @@ Response::ResponseCode AbstractServerSocketInterface::cmdReplayGetCode(const Com
Response::ResponseCode AbstractServerSocketInterface::cmdReplaySubmitCode(const Command_ReplaySubmitCode &cmd,
ResponseContainer & /*rc*/)
{
if (authState != PasswordRight) {
return Response::RespFunctionNotAllowed;
}
// code is of the form <game-id>-<hash>
QString code = QString::fromStdString(cmd.replay_code());
QStringList split = code.split("-");