Anticheat: Safeguard length against unsafe access in WARDEN_CMSG_CHEA…

…T_CHECKS_RESULT
cmangos · Jul 24, 2024 · 3fadd9f · 3fadd9f · the8887 · Aug 10, 2024
1 parent a364c15
commit 3fadd9f
Showing 1 changed file with 8 additions and 0 deletions.
diff --git a/src/game/Anticheat/module/Warden/warden.cpp b/src/game/Anticheat/module/Warden/warden.cpp
@@ -418,6 +418,14 @@ void Warden::HandlePacket(WorldPacket& recvData)
                 uint32 checksum;
                 recvData >> length >> checksum;
 
+                if (length > (recvData.size() - (recvData.rpos() + 1)))
+                {
+                    recvData.rpos(recvData.wpos());
+                    _anticheat->RecordCheatInternal(CheatType::CHEAT_TYPE_WARDEN, "Packet checksum length fail");
+                    _session->KickPlayer();
+                    return;
+                }
+
                 if (BuildChecksum(recvData.contents() + recvData.rpos(), length) != checksum)
                 {
                     recvData.rpos(recvData.wpos());