From af76b41ace2917ece0aa3f97e4f46e095a7c815f Mon Sep 17 00:00:00 2001 From: Shauren Date: Sun, 16 Oct 2022 16:31:58 +0200 Subject: Core/Networking: Fixed possible buffer overflows in WorldSocket::WritePacketToBuffer Closes #28370 --- src/server/game/Server/WorldSocket.cpp | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) (limited to 'src') diff --git a/src/server/game/Server/WorldSocket.cpp b/src/server/game/Server/WorldSocket.cpp index f762e100f3d..3dfd2d58564 100644 --- a/src/server/game/Server/WorldSocket.cpp +++ b/src/server/game/Server/WorldSocket.cpp @@ -203,10 +203,11 @@ bool WorldSocket::Update() MessageBuffer buffer(_sendBufferSize); while (_bufferQueue.Dequeue(queued)) { - uint32 packetSize = queued->size(); + uint32 packetSize = queued->size() + 2 /*opcode*/; if (packetSize > MinSizeForCompression && queued->NeedsEncryption()) - packetSize = compressBound(packetSize) + sizeof(CompressedWorldPacket); + packetSize = deflateBound(_compressionStream, packetSize) + sizeof(CompressedWorldPacket); + // Flush current buffer if too small for next packet if (buffer.GetRemainingSpace() < packetSize + sizeof(PacketHeader)) { QueuePacket(std::move(buffer)); @@ -215,7 +216,7 @@ bool WorldSocket::Update() if (buffer.GetRemainingSpace() >= packetSize + sizeof(PacketHeader)) WritePacketToBuffer(*queued, buffer); - else // single packet larger than 4096 bytes + else // single packet larger than _sendBufferSize { MessageBuffer packetBuffer(packetSize + sizeof(PacketHeader)); WritePacketToBuffer(*queued, packetBuffer); -- cgit v1.2.3