mirror of
https://github.com/godotengine/godot
synced 2024-10-14 15:52:29 +00:00
2eadbe7b78
A number of early continue cases applied the packet-provided `size` without validation, allowing large uint32_t values to be treated as negative offsets and leading to segfaults. Now, we validate `size` against the buffer length immediately to avoid a crash. This could be triggered by receiving sync data for a synchronizer who's root node had just been removed, since the code path that checked for unusable sync state failed to advance the offset. Thus the next read could interpret part of the payload as such an invalid `size`. Now, we properly advance the read offset in that case (and raise a better error). |
||
|---|---|---|
| .. | ||
| doc_classes | ||
| editor | ||
| config.py | ||
| multiplayer_debugger.cpp | ||
| multiplayer_debugger.h | ||
| multiplayer_spawner.cpp | ||
| multiplayer_spawner.h | ||
| multiplayer_synchronizer.cpp | ||
| multiplayer_synchronizer.h | ||
| register_types.cpp | ||
| register_types.h | ||
| scene_cache_interface.cpp | ||
| scene_cache_interface.h | ||
| scene_multiplayer.cpp | ||
| scene_multiplayer.h | ||
| scene_replication_config.cpp | ||
| scene_replication_config.h | ||
| scene_replication_interface.cpp | ||
| scene_replication_interface.h | ||
| scene_rpc_interface.cpp | ||
| scene_rpc_interface.h | ||
| SCsub | ||