Fixed Stupid long CSAYs can still crash the game

[Liliam]

>csay aaaaaaaaa\aaaaaaaaa\aaaaaaaaa\aaaaaaaaa\aaaaaaaaa\aaaaaaaaa\aaaaaaaaa\aaaaaaaaa\aaaaaaaaa\aaaaaaaaa\aaaaaaaaa\aaaaaaaaaa
Server message: aaaaaaaaa\aaaaaaaaa\aaaaaaaaa\aaaaaaaaa\aaaaaaaaa\aaaaaaaaa\aaaaaaaaa\aaaaaaaaa\aaaaaaaaa\aaaaaaaaa\aaaaaaaaa\aaaaaaaaaa
I_ShutdownMouse()
I_ShutdownKeyboard()
I_ShutdownTcpDriver: shut down
I_ShutdownMIDIMusic: 
I_ShutdownDigMusic:
 Done
I_ShutdownSound()
I_ShutdownGraphics()
signal_handler() error: segment violation

EIP=77c47ab4

 

[AlamGBC]

EIP=77c47ab4

oh wonderful, an invalid IP localtion, I guess the x86 stack was overwrite with the aaaaaaaaaa message

 

[Spazzo]

Todo: Test with CECHO

 

[Liliam]

CECHO does not cause this. This is not a problem with drawing centered strings, it's a problem sending the message to the other users.

Tested it with a verified joiner. Both clients just crap out (no sigsegv message), but the following is output to the error log:

Registers:
EAX=00000000 CS=001b EIP=676d6f67 EFLGS=00210246
EBX=6d6f676d SS=0023 ESP=0022fdfc EBP=6d6f676d
ECX=7c810eb6 DS=0023 ESI=676d6f67 FS=003b
EDX=00000007 ES=0023 EDI=6f676d6f GS=0000
Command Line parameters: Bytes at CS : EIP:

And it just cuts off.

Could this just be a problem of CSAY not having a message size limit?

 

[AlamGBC]

Could this just be a problem of CSAY not having a message size limit?

I have to say, yes, and the whole x86 stack is smashed....

hey, this is a buffer overflow crash/exploit!