Vulnerabilities on receiving null commands
#2

CallLocalFunction crashes if passing an empty string, which is what it's trying to do on line 87.

Additionally, line 92 will be trying to check "cmdtext[pos]" where pos = 1, an invalid index of the array since it's an empty string.

I suppose zcmd doesn't handle empty strings in OnPlayerCommandText because it should never receive one - it is indeed a bug in the server. To protect against this you could use something like "if(isnull(cmdtext)) return 0;" at the top of OnPlayerCommandText... and ideally ban anyone who's trying to break your server!
Reply


Messages In This Thread
Vulnerabilities on receiving null commands - by leong124 - 22.12.2012, 08:31
Re: Vulnerabilities on receiving null commands - by ev0lution - 22.12.2012, 09:18
Re: Vulnerabilities on receiving null commands - by AndreT - 22.12.2012, 09:24
Re: Vulnerabilities on receiving null commands - by leong124 - 22.12.2012, 09:32
Re: Vulnerabilities on receiving null commands - by ev0lution - 22.12.2012, 09:59
Re: Vulnerabilities on receiving null commands - by Kar - 23.12.2012, 04:22
Re: Vulnerabilities on receiving null commands - by Lorenc_ - 23.12.2012, 07:17
Re: Vulnerabilities on receiving null commands - by leong124 - 26.12.2012, 18:42
Respuesta: Vulnerabilities on receiving null commands - by Jupit3r - 27.12.2012, 12:20
Re: Vulnerabilities on receiving null commands - by Lorenc_ - 27.12.2012, 22:52
Re: Vulnerabilities on receiving null commands - by leong124 - 28.12.2012, 08:16
Re: Vulnerabilities on receiving null commands - by ikkentim - 05.01.2013, 10:00
Re: Vulnerabilities on receiving null commands - by leong124 - 05.01.2013, 11:46
Re: Vulnerabilities on receiving null commands - by mastermax7777 - 06.01.2013, 04:10
Re: Vulnerabilities on receiving null commands - by leong124 - 06.01.2013, 14:19
Re: Vulnerabilities on receiving null commands - by Karlip - 08.01.2013, 15:47
Re: Vulnerabilities on receiving null commands - by leong124 - 08.01.2013, 19:30
Re: Vulnerabilities on receiving null commands - by kurta999 - 08.01.2013, 20:23
Re: Vulnerabilities on receiving null commands - by leong124 - 09.01.2013, 08:06

Forum Jump:


Users browsing this thread: 1 Guest(s)