PDA

View Full Version : OP_Emote client crash fix


image
02-12-2014, 09:12 PM
void Client::Handle_OP_Emote(const EQApplicationPacket *app)
{
if(app->size != sizeof(Emote_Struct)) {
LogFile->write(EQEMuLog::Error, "Received invalid sized "
"OP_Emote: got %d, expected %d", app->size,
sizeof(Emote_Struct));
DumpPacket(app);
return;
}

// Calculate new packet dimensions
Emote_Struct* in = (Emote_Struct*)app->pBuffer;
const char* name = GetName();
uint32 len_name = strlen(name);
uint32 len_msg = strnlen(in->message,958);
uint32 len_packet = sizeof(in->unknown01) + len_name
+ len_msg + 1;

// Construct outgoing packet
EQApplicationPacket* outapp = new EQApplicationPacket(OP_Emote, len_packet);
Emote_Struct* out = (Emote_Struct*)outapp->pBuffer;
out->unknown01 = in->unknown01;
memcpy(out->message, name, len_name);

memcpy(&out->message[len_name], in->message, len_msg);

out->message[len_name] = 0x20;
out->message[len_name + len_msg - 1] = '\0';

entity_list.QueueCloseClients(this, outapp, true, 100,0,true,FILTER_SOCIALS);

safe_delete(outapp);
return;
}

For other char arrays from client:

int Client::sanitizeCharArray(char* inArray, char* outData, int maxLength)
{
int length = strnlen(inArray,maxLength);
strncpy(outData,inArray,length);
outData[length] = '\0';
return length;
}

example:


char targetName[64];
int targetLength = sanitizeCharArray(c->name, (char*)targetName, 64);

Opcodes that have char arrays of concern:

Handle_OP_Consent
Handle_OP_ConsentDeny
Handle_OP_Surname
Handle_OP_ChannelMessage
Handle_OP_GMLastName
Handle_OP_LFGCommand
Handle_OP_GroupInvite2
Handle_OP_GroupCancelInvite
Handle_OP_InspectAnswer