|
Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com |
[Full-disclosure] Re: In-game /ignore crash in Soldier of Fortune II 1.03
From: Slawek (sgp
telsatgp.com.pl)
Date: Fri Jul 01 2005 - 16:11:45 CDT
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Hello!
In message to <bugtraqsecurityfocus.com>; <bugssecuritytracker.com>;
<newssecuriteam.com>; <full-disclosurelists.grok.org.uk>;
<vulnsecunia.com> sent Wed, 29 Jun 2005 20:32:51 +0000 you wrote:
LA> #######################################################################
LA> Luigi Auriemma
LA> Application: Soldier of Fortune II
LA> http://sof2.ravensoft.com
LA> Versions: 1.02x and 1.03
LA> Platforms: Windows, Linux and Mac
LA> Bug: bad memory access
LA> Exploitation: remote, versus server (in-game)
LA> Date: 29 Jun 2005
LA> Author: unknown, found in the wild and reported to me by two
LA> admins
LA> Advisory: Luigi Auriemma
LA> e-mail: aluigiautistici.org
LA> web: http://aluigi.altervista.org
[...]
LA> ======
LA> 4) Fix
LA> ======
LA> The game is no longer supported so there is no official fix.
LA> The correct way for removing the problem is patching the bug into the
LA> latest SDK available for the game (1.02 + 1.03) and recompiling it.
LA> The patch consists in the adding of the following instruction in
LA> g_cmds.c after "ignoree = atoi( buffer );" at line 1962:
LA> if(ignoree > MAX_GENTITIES) return;
I'm afraid it's not enough.
Unfortunatelly ignoree is declared "int" so you should test for negative
values as well.
Also used table is MAX_GENTITIES long, so ignoree being equal MAX_GENTITIES
is invalid.
Correct test should rather look like this:
if ((ignoree < 0) || (ignoree >= MAX_GENTITIES)) return;
------------------------------------------
Slawomir Piotrowski / Telsat GP
Rejestracja Czasu Pracy i Kontrola Dostepu
http://www.ewidencja-czasu-pracy.pl
------------------------------------------
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]