46 Commits

Author SHA1 Message Date
Kawe Mazidjatari
5d9b9ec9d5 Fix CVE-2023-38546
Merge: curl/curl@61275672b4
2024-04-05 16:21:45 +02:00
Kawe Mazidjatari
b64897d4c1 Remove extraneous cURL compile option
Because already set from global CMake init.
2023-06-17 16:31:26 +02:00
Kawe Mazidjatari
788f38b428 Adjust cURL compile options
- Disable function inlining entirely, this allows for much easier hooking between engine and SDK code (the compiled code is now identical between engine and SDK, except that the SDK has all relevant security problems patched as per https://curl.se/docs/vuln-7.54.0.html).
- Enable buffer security checks to avoid potential remote attacks.
2023-06-17 01:07:07 +02:00
Kawe Mazidjatari
3f8baf6f68 Allow setting compile options for specific targets
Previously, it was all controlled from the global init (applied to all projects), but some projects need different options. With these changes, you can disable the common options applied in the 'add_module' macro, and set your own if desired.
2023-06-17 00:45:27 +02:00
Kawe Mazidjatari
f6e6f834ce Enable cURL IPv6 2023-06-16 23:09:38 +02:00
Kawe Mazidjatari
4090757035 Fix CVE-2023-27533
Merge: curl/curl@538b1e79a6
2023-06-13 16:49:15 +02:00
Kawe Mazidjatari
1d570a82d8 Fix CVE-2022-43552
Merge: curl/curl@4f20188ac6
2023-06-13 16:18:00 +02:00
Kawe Mazidjatari
634a4739db Fix CVE-2022-32221
Merge: curl/curl@a64e3e5993
2023-06-13 15:35:04 +02:00
Kawe Mazidjatari
0cbdc982fd Fix CVE-2022-35252
Merge: curl/curl@8dfc93e573
2023-06-13 15:31:23 +02:00
Kawe Mazidjatari
e9ba4540cd Fix CVE-2022-27774
Merge: curl/curl@139a54ed0a
Note: protocol compare couldn't be added, as this would require adding a new member in the state structure, and therefore, break compatibility with the structures in the compiled executable (breaking the ability to hook any of its code). This fix should be sufficient however.
2023-06-13 13:02:04 +02:00
Kawe Mazidjatari
926a34dbbb Fix CVE-2022-22576
Merge: curl/curl@852aa5ad35
2023-06-13 12:20:54 +02:00
Kawe Mazidjatari
8b24c4f7d8 Fix CVE-2021-22947
Merge: curl/curl@8ef147c436
2023-06-13 12:08:13 +02:00
Kawe Mazidjatari
f545af934a Fix CVE-2021-22946
Merge: curl/curl@364f174724
2023-06-13 11:38:31 +02:00
Kawe Mazidjatari
9529519fa3 Fix CVE-2021-22925
Merge: curl/curl@894f6ec730
2023-06-13 11:30:39 +02:00
Kawe Mazidjatari
44650ac245 Fix CVE-2021-22898
Merge: curl/curl@39ce47f219
2023-06-13 09:47:07 +02:00
Kawe Mazidjatari
b7cca52067 Fix CVE-2021-22876
Merge: curl/curl@7214288898
Note: The 'CURLU' class does not exist in this particular version of curl, therefore, an alternative approach has been incorporated to mitigate the issue. Code has been tested, and the issue has been fixed.
2023-06-13 09:45:16 +02:00
Kawe Mazidjatari
d177ecdb0a Fix CVE-2020-8286
Merge: curl/curl@d9d0167278
2023-06-13 01:35:15 +02:00
Kawe Mazidjatari
c38a5f214f Fix CVE-2020-8285
Merge: curl/curl@69a358f218
Note: due to the many updates between the curl version this has been fixed in, and the one used in the SDK, the function was slightly different. The code has been tested however, after implementing the fix for this particular version of the library, the code appears to work perfectly with the vuln being fixed (tested on an FTP server with 10k files in the directory).
2023-06-13 00:38:35 +02:00
Kawe Mazidjatari
5a9711878b Fix CVE-2020-8284
Merge: curl/curl@ec9cc725d5
2023-06-12 22:26:53 +02:00
Kawe Mazidjatari
d10b544f74 Fix CVE-2020-8231
Merge: curl/curl@3c9e021f86
Note: Member order in 'connfind' has been left identical, except for that 'found' (now 'id_tofind') is a long. Code however, should pad it to a 4 byte boundary. Size of 'UrlState' has also remained unchanged, the 'connectdata' member has been renamed to 'lastconnect_id', and its type has been changed to 'long'. Additional padding has been incorporated to make sure the structure's size remains the same as that of the game, may we ever hook compiled code with ours.
2023-06-12 22:20:39 +02:00
Kawe Mazidjatari
0ac029e1c0 Fix CVE-2019-5481
Merge: curl/curl@9069838b30
2023-06-12 21:36:38 +02:00
Kawe Mazidjatari
0920fb834a Fix CVE-2019-5482
Merge: curl/curl@facb0e4662
2023-06-12 21:34:01 +02:00
Kawe Mazidjatari
5e68af6eb5 Fix CVE-2019-5436
Merge: curl/curl@2576003415
2023-06-12 21:22:22 +02:00
Kawe Mazidjatari
fa05fbd1aa Fix CVE-2018-16890
Merge: curl/curl@b780b30d13
2023-06-12 20:51:12 +02:00
Kawe Mazidjatari
52d8ef5719 Fix CVE-2019-3822
Merge: curl/curl@50c9484278
2023-06-12 20:48:21 +02:00
Kawe Mazidjatari
46f11218c6 Fix 'CVE-2019-3823'
Merge: curl/curl@39df4073e5
2023-06-12 20:44:02 +02:00
Kawe Mazidjatari
a022f81bc4 Fix 'CVE-2018-16839'
Merge: curl/curl@f3a24d7916
2023-06-12 20:37:57 +02:00
Kawe Mazidjatari
1e4843fda3 Fix 'CVE-2018-14618'
Merge: curl/curl@8c7b3737d2
2023-06-12 20:27:51 +02:00
Kawe Mazidjatari
6c34f8dc4e Fix 'CVE-2018-1000301'
Merge: curl/curl@8c7b3737d2
2023-06-12 20:17:01 +02:00
Kawe Mazidjatari
2aee31375f Fix 'CVE-2018-1000122'
Merge: curl/curl@d52dc4760f
2023-06-12 20:13:24 +02:00
Kawe Mazidjatari
6069e9f00b Fix 'CVE-2018-1000121'
Merge: curl/curl@9889db0433
2023-06-12 20:09:12 +02:00
Kawe Mazidjatari
2739ff3a7d Fix 'CVE-2018-1000120'
Merge: curl/curl@535432c0ad
2023-06-12 20:06:31 +02:00
Kawe Mazidjatari
f3b27f66bb Fix 'CVE-2018-1000007'
Merge: curl/curl@af32cd3859
2023-06-12 19:56:24 +02:00
Kawe Mazidjatari
2905bcad53 Fix 'CVE-2018-1000005'
Merge: curl/curl@fa3dbb9a14
2023-06-12 19:47:37 +02:00
Kawe Mazidjatari
d000c0c3b3 Fix 'CVE-2017-8817'
Merge: curl/curl@0b664ba968
2023-06-12 19:44:01 +02:00
Kawe Mazidjatari
e48b68e870 Fix 'CVE-2017-8816'
Merge: curl/curl@7f2a1df6f5
2023-06-12 19:36:18 +02:00
Kawe Mazidjatari
bc2a6ae586 Fix 'CVE-2017-1000257'
Merge: curl/curl@13c9a9ded3
2023-06-12 19:33:12 +02:00
Kawe Mazidjatari
c6ee89d1a4 Fix 'CVE-2017-1000254'
Merge: curl/curl@5ff2c5ff25
2023-06-12 19:30:53 +02:00
Kawe Mazidjatari
e6cb575586 Fix 'CVE-2017-9502'
Merge: curl/curl@5d7952f52e
2023-06-12 19:22:14 +02:00
Kawe Mazidjatari
4368210a5c Fix 'CVE-2017-1000100'
Merge: curl/curl@358b2b131a
2023-06-12 19:13:50 +02:00
Kawe Mazidjatari
9f44bcc818 Treat compiler warnings as errors
Treat them as errors globally. Most of the time a warning is a bug, or problem in code that could be solved in a different (better) manner. Thirdparty code have this disabled. The warnings as errors option can be globally disabled through the CMake GUI, but this is not recommended.
2023-05-15 09:44:26 +02:00
Kawe Mazidjatari
8dbc2024c6 CMake code improvements
Use the 'add_module' macro to add modules without creating duplicate code. This macro also takes a reuse PCH as parameter, so modules that need a precompiled header, could reuse those from different targets that compile them. This commit also restructures the group order of the generated solution files for easier code navigation.
2023-05-13 00:14:53 +02:00
Kawe Mazidjatari
f120354e96 Initial port to CMake
* All libraries have been isolated from each other, and build into separate artifacts.
* Project has been restructured to support isolating libraries.
* CCrashHandler now calls a callback on crash (setup from core/dllmain.cpp, this can be setup in any way for any project. This callback is getting called when the apllication crashes. Useful for flushing buffers before closing handles to logging files for example).
* Tier0 'CoreMsgV' function now calls a callback sink, which could be set by the user (currently setup to the SDK's internal logger in core/dllmain.cpp).

TODO:
* Add a batch file to autogenerate all projects.
* Add support for dedicated server.
* Add support for client dll.

Bugs:
* Game crashes on the title screen after the UI script compiler has finished (root cause unknown).
* Curl error messages are getting logged twice for the dedicated server due to the removal of all "DEDICATED" preprocessor directives to support isolating projects. This has to be fixed properly!
2023-05-10 00:05:38 +02:00
Kawe Mazidjatari
387b24875b Downgrade 'libcurl' to 7.54.0
The game uses 7.54.0, downgraded to maintain compatibility if we ever hook curl functions.
2023-03-28 23:14:26 +02:00
Kawe Mazidjatari
c1107fb4ed Fix spelling 2023-02-12 16:27:09 +01:00
Kawe Mazidjatari
b8bbe6e6d0 Add libcurl to project 2023-01-26 13:09:18 +01:00