From 6ab2c9dbbfc6892a554ee9e48f7214aaca24eb8d Mon Sep 17 00:00:00 2001 From: Alibek Omarov Date: Tue, 22 Oct 2024 02:13:30 +0300 Subject: [PATCH] engine: client: fix out of bounds access with some ticket generators * Update MultiEmulator submodule --- 3rdparty/MultiEmulator | 2 +- engine/client/cl_main.c | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/3rdparty/MultiEmulator b/3rdparty/MultiEmulator index 63f9145b..7ab212ba 160000 --- a/3rdparty/MultiEmulator +++ b/3rdparty/MultiEmulator @@ -1 +1 @@ -Subproject commit 63f9145bd03def93dae3b7fe977b78e4ab312189 +Subproject commit 7ab212babb32d9216408af08c24fab59e6a57e19 diff --git a/engine/client/cl_main.c b/engine/client/cl_main.c index d35fb733..77863c75 100644 --- a/engine/client/cl_main.c +++ b/engine/client/cl_main.c @@ -1079,12 +1079,12 @@ static void CL_WriteSteamTicket( sizebuf_t *send ) { const char *s; uint32_t crc; - char buf[512] = { 0 }; + char buf[768] = { 0 }; // setti and steamemu return 768 size_t i = sizeof( buf ); if( !Q_strcmp( cl_ticket_generator.string, "null" )) { - MSG_WriteBytes( send, buf, sizeof( buf )); + MSG_WriteBytes( send, buf, 512 ); // specifically 512 bytes of zeros return; }