From 4969a840300bbafbc5a47f06fef41751a5620fc9 Mon Sep 17 00:00:00 2001 From: Kawe Mazidjatari <48657826+Mauler125@users.noreply.github.com> Date: Wed, 7 Jun 2023 21:21:55 +0200 Subject: [PATCH] Fix desync in CUtlbuffer::ParseToken The if statement comparing 'nLen' with 'nMaxLen' increments 'nLen' first at all times, but the statement below that checks the delimiters seeks -1 from current pos, causing a desync. This could result in reading arbitrary memory on certain strings. This fix also fixes the useless need to 'snag' the delimiters from tokens. --- r5dev/tier1/utlbuffer.cpp | 3 --- 1 file changed, 3 deletions(-) diff --git a/r5dev/tier1/utlbuffer.cpp b/r5dev/tier1/utlbuffer.cpp index 3d62423e..5918c2a8 100644 --- a/r5dev/tier1/utlbuffer.cpp +++ b/r5dev/tier1/utlbuffer.cpp @@ -1429,10 +1429,7 @@ int64 CUtlBuffer::ParseToken(characterset_t* pBreaks, char* pTokenBuf, int64 nMa break; if (IN_CHARACTERSET(*pBreaks, c) || c == '\"' || c <= ' ') - { - SeekGet(SEEK_CURRENT, -1); break; - } } pTokenBuf[nLen] = 0;