You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Entering a server with team names longer than 9 symbols causes incorrect behavior or a crash.
I investigated the problem after reading issue #737 which incorrectly identified the cause of the crash.
The issue is easy to fix, but perhaps the fix should not emulate the original client's handling, but accommodate these longer names if the server protocol should ever be altered further down the line; the 9 symbol name restriction is an arbitrary choice after all...
PySpades and PySnip load the full team name strings from their config files, and send them untruncated to clients.
The team names' packet normally looks like this:
No information is lost, however; it's just pushed further out to make room for the names.
Map objects are glitched if either team name buffers exceed 10 chars, but I can't say if this is a client-side or server-side problem.
Effects in clients:
This is safe:
"Team 1 na\0"
"Team 2 na\0"
This isn't:
"Team 1 nam\0" -- Team 2's name buffer terminates at char 0, meaning it has a blank name.
"Team 1 name\0" -- Team 1's name buffer bleeds into team 2's, making team 2's name "e". Note that this is "correct" behavior, as it's not dangerous and happens in the original client.
"Team 2 nam\0" -- Bleeds over null byte, but isn't problematic. the "m" is visible in OpenSpades, but not in the original client.
"Team 2 name\0" -- Expected final "e" is strangely not visible in OpenSpades.
"Team 2 namex\0" -- Immediate crash in OpenSpades.
Memory excerpt of the original client's packet buffer:
Indeed, the in-game result is "Team 1 te" for team 1, and "ting name" for team 2.
12 bytes, "Team 1 testi", was copied into team 1's buffer, then a null byte was placed into the tenth byte to make sure it's terminated, then the part that overlapped into team 2's buffer is given the same treatment.
Edited to remove stupid scary words like "code execution" and "undefined behavior" because I've since actually read the source code and seen how unfounded my initial assessment was, and I've fixed and added some information.
The text was updated successfully, but these errors were encountered:
Entering a server with team names longer than 9 symbols causes incorrect behavior or a crash.
I investigated the problem after reading issue #737 which incorrectly identified the cause of the crash.
The issue is easy to fix, but perhaps the fix should not emulate the original client's handling, but accommodate these longer names if the server protocol should ever be altered further down the line; the 9 symbol name restriction is an arbitrary choice after all...
PySpades and PySnip load the full team name strings from their config files, and send them untruncated to clients.
The team names' packet normally looks like this:
The buffers will always be 10 bytes long each if their contents fit.
But when they don't fit, they expand the packet:
No information is lost, however; it's just pushed further out to make room for the names.
Map objects are glitched if either team name buffers exceed 10 chars, but I can't say if this is a client-side or server-side problem.
Effects in clients:
This is safe:
"Team 1 na\0"
"Team 2 na\0"
This isn't:
"Team 1 nam\0" -- Team 2's name buffer terminates at char 0, meaning it has a blank name.
"Team 1 name\0" -- Team 1's name buffer bleeds into team 2's, making team 2's name "e". Note that this is "correct" behavior, as it's not dangerous and happens in the original client.
"Team 2 nam\0" -- Bleeds over null byte, but isn't problematic. the "m" is visible in OpenSpades, but not in the original client.
"Team 2 name\0" -- Expected final "e" is strangely not visible in OpenSpades.
"Team 2 namex\0" -- Immediate crash in OpenSpades.
Memory excerpt of the original client's packet buffer:
Memory excerpt of the permanent team name buffers after modifying the packet buffer's contents:
Indeed, the in-game result is "Team 1 te" for team 1, and "ting name" for team 2.
12 bytes, "Team 1 testi", was copied into team 1's buffer, then a null byte was placed into the tenth byte to make sure it's terminated, then the part that overlapped into team 2's buffer is given the same treatment.
Edited to remove stupid scary words like "code execution" and "undefined behavior" because I've since actually read the source code and seen how unfounded my initial assessment was, and I've fixed and added some information.
The text was updated successfully, but these errors were encountered: