summaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
authorrubidium42 <rubidium@openttd.org>2021-05-02 11:05:50 +0200
committerrubidium42 <rubidium42@users.noreply.github.com>2021-05-02 11:51:28 +0200
commit56aa6d0eddb60fac20cde82cd496005369ca1b8d (patch)
treec42f6531d63827167fffe1f958060343e10fb535 /src
parent18651dd8b13d8a427ae71d8af00792d52ad9ed60 (diff)
downloadopenttd-56aa6d0eddb60fac20cde82cd496005369ca1b8d.tar.xz
Fix: [Network] Reading beyond the length of the server's ID when hashing password
Under normal circumstances the server's ID is 32 characters excluding '\0', however this can be changed at the server. This ID is sent to the server for company name hashing. The client reads it into a statically allocated buffer of 33 bytes, but fills only the bytes it received from the server. However, the hash assumes all 33 bytes are set, thus potentially reading uninitialized data, or a part of the server ID of a previous game in the hashing routine. It is still reading from memory assigned to the server ID, so nothing bad happens, except that company passwords might not work correctly.
Diffstat (limited to 'src')
-rw-r--r--src/network/network.cpp9
1 files changed, 6 insertions, 3 deletions
diff --git a/src/network/network.cpp b/src/network/network.cpp
index af732facd..c00a3650f 100644
--- a/src/network/network.cpp
+++ b/src/network/network.cpp
@@ -176,12 +176,15 @@ const char *GenerateCompanyPasswordHash(const char *password, const char *passwo
if (StrEmpty(password)) return password;
char salted_password[NETWORK_SERVER_ID_LENGTH];
+ size_t password_length = strlen(password);
+ size_t password_server_id_length = strlen(password_server_id);
- memset(salted_password, 0, sizeof(salted_password));
- seprintf(salted_password, lastof(salted_password), "%s", password);
/* Add the game seed and the server's ID as the salt. */
for (uint i = 0; i < NETWORK_SERVER_ID_LENGTH - 1; i++) {
- salted_password[i] ^= password_server_id[i] ^ (password_game_seed >> (i % 32));
+ char password_char = (i < password_length ? password[i] : 0);
+ char server_id_char = (i < password_server_id_length ? password_server_id[i] : 0);
+ char seed_char = password_game_seed >> (i % 32);
+ salted_password[i] = password_char ^ server_id_char ^ seed_char;
}
Md5 checksum;