mirror of
https://github.com/Mauler125/r5sdk.git
synced 2025-02-09 19:15:03 +01:00
7912b79fa2
Implement bounds check for non-sanitized value of u.m_nNewEntity. Debug builds of the engine have an assertion, however in release these are stripped. This fixes a full chain client RCE exploit, for more information, see: https://ctf.re/source-engine/exploitation/2021/05/01/source-engine-2/
33 lines
1.2 KiB
C++
33 lines
1.2 KiB
C++
#ifndef CL_ENTS_PARSE_H
|
|
#define CL_ENTS_PARSE_H
|
|
|
|
inline CMemory p_CL_CopyExistingEntity;
|
|
inline auto v_CL_CopyExistingEntity = p_CL_CopyExistingEntity.RCast<bool (*)(__int64 a1, unsigned int* a2, char* a3)>();
|
|
|
|
|
|
///////////////////////////////////////////////////////////////////////////////
|
|
class V_CL_Ents_Parse : public IDetour
|
|
{
|
|
virtual void GetAdr(void) const
|
|
{
|
|
spdlog::debug("| FUN: CL_CopyExistingEntity : {:#18x} |\n", p_CL_CopyExistingEntity.GetPtr());
|
|
spdlog::debug("+----------------------------------------------------------------+\n");
|
|
}
|
|
virtual void GetFun(void) const
|
|
{
|
|
p_CL_CopyExistingEntity = g_GameDll.FindPatternSIMD(reinterpret_cast<rsig_t>("\x40\x53\x48\x83\xEC\x70\x4C\x63\x51\x28"), "xxxxxxxxxx");
|
|
v_CL_CopyExistingEntity = p_CL_CopyExistingEntity.RCast<bool (*)(__int64, unsigned int*, char*)>(); /*40 53 48 83 EC 70 4C 63 51 28*/
|
|
}
|
|
virtual void GetVar(void) const { }
|
|
virtual void GetCon(void) const { }
|
|
virtual void Attach(void) const { }
|
|
virtual void Detach(void) const { }
|
|
};
|
|
///////////////////////////////////////////////////////////////////////////////
|
|
|
|
void CL_Ents_Parse_Attach();
|
|
void CL_Ents_Parse_Detach();
|
|
|
|
REGISTER(V_CL_Ents_Parse);
|
|
#endif // !CL_ENTS_PARSE_H
|