netPanzer-0.8.txt

`  
#######################################################################  
  
Luigi Auriemma  
  
Application: netPanzer  
http://www.netpanzer.org  
http://netpanzer.berlios.de  
Versions: <= 0.8 (rev 952)  
Platforms: *nix, *BSD, Windown, Mac and others  
Bug: server termination  
Exploitation: remote, versus server  
Date: 23 May 2006  
Author: Luigi Auriemma  
e-mail: [email protected]  
web: aluigi.org  
  
  
#######################################################################  
  
  
1) Introduction  
2) Bug  
3) The Code  
4) Fix  
  
  
#######################################################################  
  
===============  
1) Introduction  
===============  
  
  
netPanzer is a nice and well known open source multiplayer strategy  
game.  
  
  
#######################################################################  
  
======  
2) Bug  
======  
  
  
The game is affected by a denial of service which happens when a client  
uses a flag (called also frameNum) major than 41 since the setFrame  
function in src/Lib/2D/Surface.hpp checks if this number is minor than  
frameCount:  
  
void setFrame(const float &frameNum)  
{  
assert(frameNum >= 0.0);  
assert(frameNum < frameCount);  
mem = frame0 + (pix.y * stride) * int(frameNum);  
}  
  
The result is the immediate interruption of the server:  
  
netpanzer: src/Lib/2D/Surface.hpp:370: void Surface::setFrame(const  
float&): Assertion `frameNum < frameCount' failed. Received signal  
SIGABRT(6) aborting and trying to shutdown.  
Closing logfile.  
Aborted  
  
  
#######################################################################  
  
===========  
3) The Code  
===========  
  
  
http://aluigi.org/poc/panza.zip  
  
  
#######################################################################  
  
======  
4) Fix  
======  
  
  
No fix.  
No reply from the developers.  
  
  
#######################################################################  
  
  
---   
Luigi Auriemma  
http://aluigi.org  
http://mirror.aluigi.org  
`