Commit: b9a1f917b4bf2a16a13609908d38c8c215e6d76d - zandronum-tspg (hg)

This is a fork of Zandronum used on servers hosted by The Sentinels Playground (TSPG).

Commit MetaInfo

• Revision: b9a1f917b4bf2a16a13609908d38c8c215e6d76d (tree)
• Time: 2021-11-07 13:25:15
• Author: Adam Kaminski <kaminskiadam9@gmai...>
• Commiter: Adam Kaminski

Log Message

Make sure we've read the entire byte stream of a CLC_SAY command before making any important checks. Also added a check so that clients can't maliciously send private messages to themselves.

Change Summary

• modified: src/sv_main.cpp

Incremental Difference

diff -r e78afec5d491 -r b9a1f917b4bf src/sv_main.cpp
--- a/src/sv_main.cpp	Fri Nov 05 18:54:13 2021 -0400
+++ b/src/sv_main.cpp	Sun Nov 07 00:25:15 2021 -0400
@@ -5715,6 +5715,12 @@
 
 	// [AK] If we're sending a private message to a player, get their index number.
 	if ( ulChatMode == CHATMODE_PRIVATE_SEND )
+		ulReceiver = pByteStream->ReadByte();
+
+	// Read in the chat string.
+	const char	*pszChatString = pByteStream->ReadString();
+
+	if ( ulChatMode == CHATMODE_PRIVATE_SEND )
 	{
 		// [AK] Don't send the message if we disabled private messaging.
 		if ( zadmflags & ZADF_NO_PRIVATE_CHAT )
@@ -5723,11 +5729,13 @@
 			return ( false );
 		}
 
-		ulReceiver = pByteStream->ReadByte();
-	}
-
-	// Read in the chat string.
-	const char	*pszChatString = pByteStream->ReadString();
+		// [AK] Don't let the client send a private message to themselves.
+		if ( ulPlayer == ulReceiver )
+		{
+			SERVER_PrintfPlayer( ulPlayer, "You can't send private messages to yourself.\n" );
+			return ( false );
+		}
+	}
 
 	// [BB] If the client is flooding the server with commands, the client is
 	// kicked and we don't need to handle the command.