Cockatrice/libcockatrice_network/libcockatrice
BruebachL d93f63050c
[Server] Fix unauthenticated crash via replay submit code (#7072)
cmdReplaySubmitCode dereferenced userInfo without an authentication
guard, allowing an unauthenticated connection with a valid replay code
to segfault the server. Add the same authState != PasswordRight guard
used by all other replay handlers, and gate session command dispatch on
a pre-auth whitelist so future handlers cannot be reached before login.

Took 2 minutes

Co-authored-by: Lukas Brübach <Bruebach.Lukas@bdosecurity.de>
2026-08-14 08:56:54 +02:00
..
network [Server] Fix unauthenticated crash via replay submit code (#7072) 2026-08-14 08:56:54 +02:00