5 Commits

Author SHA1 Message Date
Kawe Mazidjatari
c8648b9289 Fix typo
Typo.
2023-06-17 16:31:45 +02:00
Kawe Mazidjatari
51ea9c7c4f CUserCmd hardening
Fix several exploitable bugs in the CUserCmd class. Some of these have been used to exploit/cheat in-game. Fixes contain:
- Camera position clamping (the only patch that hasn't been tested yet!)
- Weapon activity exploit, allowing player to infinitely throw ordnances, and perform other 'cheats'.
- Akimbo exploit + server crasher, allowing client to set multiple inventory weapons as active. The active weapon index bounds were also not checked, a properly crafter CUserCmd message would therefore be able to crash the server.

Note that this does not fix all issues related to the UserCmd class; further reversing and testing revealed there is more to be fixed, these fixes will get implemented with a future commit.
2023-06-13 17:43:32 +02:00
Kawe Mazidjatari
a2468bb184 Normalize view angles in client's usercmd
Must be normalized, bad values (NAN or FLT_MAX) will crash the game. There is more that needs to be clamped, but before we can do this CUserCmd has to be reversed more.
2023-06-06 00:53:05 +02:00
Kawe Mazidjatari
4ed2e7a12a Mark as const
Mark as const.
2023-06-05 01:37:00 +02:00
Kawe Mazidjatari
11fd49efde Fix speed hack exploit
The frame time send from CL_Move is not sanitized on the server; clamp it to the same cvars the client is clamping them to so players busting out the clamps cannot speed hack. The values are replicated between the server and client, so if someone wants to tweak the values, it won't mess up on either the server or client.
2023-06-05 01:24:23 +02:00