Skip to content

Commit b6d471e

Browse files
committed
1 parent 147639a commit b6d471e

File tree

1 file changed

+6
-0
lines changed

1 file changed

+6
-0
lines changed

src/public/dt_utlvector_recv.cpp

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,12 @@ void RecvProxy_UtlVectorLength( const CRecvProxyData *pData, void *pStruct, void
3636
// to write arbitrary data to out of bounds memory.
3737
// There isn't much we can do at this point - we're deep in the networking stack, it's hard to recover
3838
// gracefully and we shouldn't be talking to this server anymore.
39+
#ifdef BDSBASE
40+
// So we notify client.
41+
Error("Server sent utlvector length value %d which is not in range [%d...%d]. Crashing client to prevent RCE...\n",
42+
pData->m_Value.m_Int, 0, pExtra->m_nMaxElements);
43+
// And crash.
44+
#endif
3945
// So we crash.
4046
*(int *) 1 = 2;
4147
}

0 commit comments

Comments
 (0)