Skip to content

Fix invalid memory access when connecting to Online Lobby #348

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

Fix invalid memory access when connecting to Online Lobby #348

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 18 additions & 18 deletions GeneralsMD/Code/GameEngine/Source/GameNetwork/GameSpy/StagingRoomGameInfo.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,7 +81,7 @@ GameSpyGameSlot::GameSpyGameSlot()
BOOL (__stdcall *SnmpExtensionInitPtr)(IN DWORD dwUpTimeReference, OUT HANDLE *phSubagentTrapEvent, OUT AsnObjectIdentifier *pFirstSupportedRegion);
BOOL (__stdcall *SnmpExtensionQueryPtr)(IN BYTE bPduType, IN OUT RFC1157VarBindList *pVarBindList, OUT AsnInteger32 *pErrorStatus, OUT AsnInteger32 *pErrorIndex);
LPVOID (__stdcall *SnmpUtilMemAllocPtr)(IN DWORD bytes);
VOID (__stdcall *SnmpUtilMemFreePtr)(IN LPVOID pMem);
VOID (__stdcall *SnmpUtilVarBindListFreePtr)(IN SnmpVarBindList *pVbl);

typedef struct tConnInfoStruct {
unsigned int State;
Expand Down Expand Up @@ -222,18 +222,14 @@ Bool GetLocalChatConnectionAddress(AsciiString serverName, UnsignedShort serverP
SnmpExtensionInitPtr = (int (__stdcall *)(unsigned long,void ** ,AsnObjectIdentifier *)) GetProcAddress(mib_ii_dll, "SnmpExtensionInit");
SnmpExtensionQueryPtr = (int (__stdcall *)(unsigned char,SnmpVarBindList *,long *,long *)) GetProcAddress(mib_ii_dll, "SnmpExtensionQuery");
SnmpUtilMemAllocPtr = (void *(__stdcall *)(unsigned long)) GetProcAddress(snmpapi_dll, "SnmpUtilMemAlloc");
SnmpUtilMemFreePtr = (void (__stdcall *)(void *)) GetProcAddress(snmpapi_dll, "SnmpUtilMemFree");
if (SnmpExtensionInitPtr == NULL || SnmpExtensionQueryPtr == NULL || SnmpUtilMemAllocPtr == NULL || SnmpUtilMemFreePtr == NULL) {
SnmpUtilVarBindListFreePtr = (void (__stdcall *)(SnmpVarBindList *)) GetProcAddress(snmpapi_dll, "SnmpUtilVarBindListFree");
if (SnmpExtensionInitPtr == NULL || SnmpExtensionQueryPtr == NULL || SnmpUtilMemAllocPtr == NULL || SnmpUtilVarBindListFreePtr == NULL) {
DEBUG_LOG(("Failed to get proc addresses for linked functions\n"));
FreeLibrary(snmpapi_dll);
FreeLibrary(mib_ii_dll);
return(false);
}


RFC1157VarBindList *bind_list_ptr = (RFC1157VarBindList *) SnmpUtilMemAllocPtr(sizeof(RFC1157VarBindList));
RFC1157VarBind *bind_ptr = (RFC1157VarBind *) SnmpUtilMemAllocPtr(sizeof(RFC1157VarBind));

/*
** OK, here we go. Try to initialise the .dll
*/
Expand All @@ -245,8 +241,6 @@ Bool GetLocalChatConnectionAddress(AsciiString serverName, UnsignedShort serverP
** Aw crap.
*/
DEBUG_LOG(("Failed to init the .dll\n"));
SnmpUtilMemFreePtr(bind_list_ptr);
SnmpUtilMemFreePtr(bind_ptr);
FreeLibrary(snmpapi_dll);
FreeLibrary(mib_ii_dll);
return(false);
Expand All @@ -270,10 +264,12 @@ Bool GetLocalChatConnectionAddress(AsciiString serverName, UnsignedShort serverP
/*
** Set up the bind list.
*/
RFC1157VarBindList bind_list;
RFC1157VarBind *bind_ptr = (RFC1157VarBind *) SnmpUtilMemAllocPtr(sizeof(RFC1157VarBind));
bind_ptr->name.idLength = ARRAY_SIZE(mib_ii_name);
bind_ptr->name.ids = mib_ii_name;
bind_list_ptr->list = bind_ptr;
bind_list_ptr->len = 1;
bind_ptr->name.ids = mib_ii_name_ptr; // mib_ii_name_ptr should be treated as a weak pointer after this point
bind_list.list = bind_ptr; // bind_ptr should be treated as a weak pointer after this point
bind_list.len = 1;


/*
Expand All @@ -291,16 +287,22 @@ Bool GetLocalChatConnectionAddress(AsciiString serverName, UnsignedShort serverP
*/
while (true) {

if (!SnmpExtensionQueryPtr(SNMP_PDU_GETNEXT, bind_list_ptr, &error_status, &error_index)) {
if (!SnmpExtensionQueryPtr(SNMP_PDU_GETNEXT, &bind_list, &error_status, &error_index)) {
//if (!SnmpExtensionQueryPtr(ASN_RFC1157_GETNEXTREQUEST, bind_list_ptr, &error_status, &error_index)) {
DEBUG_LOG(("SnmpExtensionQuery returned false\n"));
SnmpUtilMemFreePtr(bind_list_ptr);
SnmpUtilMemFreePtr(bind_ptr);
SnmpUtilVarBindListFreePtr(&bind_list);
FreeLibrary(snmpapi_dll);
FreeLibrary(mib_ii_dll);
return(false);
}

bind_ptr = bind_list.list;
if (bind_ptr == NULL) {
DEBUG_LOG(("bind_list_ptr->list unexpectedly NULL\n"));
SnmpUtilVarBindListFreePtr(&bind_list);
return false;
}

/*
** If this is something new we aren't looking for then we are done.
*/
Expand Down Expand Up @@ -393,9 +395,7 @@ Bool GetLocalChatConnectionAddress(AsciiString serverName, UnsignedShort serverP
}
}

SnmpUtilMemFreePtr(bind_list_ptr);
SnmpUtilMemFreePtr(bind_ptr);
SnmpUtilMemFreePtr(mib_ii_name_ptr);
SnmpUtilVarBindListFreePtr(&bind_list);

DEBUG_LOG(("Got %d connections in list, parsing...\n", connectionVector.size()));

Expand Down
35 changes: 18 additions & 17 deletions GeneralsMD/Code/GameEngine/Source/GameNetwork/GameSpyGameInfo.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,7 +66,7 @@ GameSpyGameSlot::GameSpyGameSlot()
BOOL (__stdcall *SnmpExtensionInitPtr)(IN DWORD dwUpTimeReference, OUT HANDLE *phSubagentTrapEvent, OUT AsnObjectIdentifier *pFirstSupportedRegion);
BOOL (__stdcall *SnmpExtensionQueryPtr)(IN BYTE bPduType, IN OUT RFC1157VarBindList *pVarBindList, OUT AsnInteger32 *pErrorStatus, OUT AsnInteger32 *pErrorIndex);
LPVOID (__stdcall *SnmpUtilMemAllocPtr)(IN DWORD bytes);
VOID (__stdcall *SnmpUtilMemFreePtr)(IN LPVOID pMem);
VOID (__stdcall *SnmpUtilVarBindListFreePtr)(IN SnmpVarBindList *pVbl);

typedef struct tConnInfoStruct {
unsigned int State;
Expand Down Expand Up @@ -207,18 +207,15 @@ Bool GetLocalChatConnectionAddress(AsciiString serverName, UnsignedShort serverP
SnmpExtensionInitPtr = (int (__stdcall *)(unsigned long,void ** ,AsnObjectIdentifier *)) GetProcAddress(mib_ii_dll, "SnmpExtensionInit");
SnmpExtensionQueryPtr = (int (__stdcall *)(unsigned char,SnmpVarBindList *,long *,long *)) GetProcAddress(mib_ii_dll, "SnmpExtensionQuery");
SnmpUtilMemAllocPtr = (void *(__stdcall *)(unsigned long)) GetProcAddress(snmpapi_dll, "SnmpUtilMemAlloc");
SnmpUtilMemFreePtr = (void (__stdcall *)(void *)) GetProcAddress(snmpapi_dll, "SnmpUtilMemFree");
if (SnmpExtensionInitPtr == NULL || SnmpExtensionQueryPtr == NULL || SnmpUtilMemAllocPtr == NULL || SnmpUtilMemFreePtr == NULL) {
SnmpUtilVarBindListFreePtr = (void (__stdcall *)(SnmpVarBindList *)) GetProcAddress(snmpapi_dll, "SnmpUtilVarBindListFree");
if (SnmpExtensionInitPtr == NULL || SnmpExtensionQueryPtr == NULL || SnmpUtilMemAllocPtr == NULL || SnmpUtilVarBindListFreePtr == NULL) {
DEBUG_LOG(("Failed to get proc addresses for linked functions\n"));
FreeLibrary(snmpapi_dll);
FreeLibrary(mib_ii_dll);
return(false);
}


RFC1157VarBindList *bind_list_ptr = (RFC1157VarBindList *) SnmpUtilMemAllocPtr(sizeof(RFC1157VarBindList));
RFC1157VarBind *bind_ptr = (RFC1157VarBind *) SnmpUtilMemAllocPtr(sizeof(RFC1157VarBind));

/*
** OK, here we go. Try to initialise the .dll
*/
Expand All @@ -230,8 +227,6 @@ Bool GetLocalChatConnectionAddress(AsciiString serverName, UnsignedShort serverP
** Aw crap.
*/
DEBUG_LOG(("Failed to init the .dll\n"));
SnmpUtilMemFreePtr(bind_list_ptr);
SnmpUtilMemFreePtr(bind_ptr);
FreeLibrary(snmpapi_dll);
FreeLibrary(mib_ii_dll);
return(false);
Expand All @@ -255,10 +250,12 @@ Bool GetLocalChatConnectionAddress(AsciiString serverName, UnsignedShort serverP
/*
** Set up the bind list.
*/
RFC1157VarBindList bind_list;
RFC1157VarBind *bind_ptr = (RFC1157VarBind *) SnmpUtilMemAllocPtr(sizeof(RFC1157VarBind));
bind_ptr->name.idLength = ARRAY_SIZE(mib_ii_name);
bind_ptr->name.ids = mib_ii_name;
bind_list_ptr->list = bind_ptr;
bind_list_ptr->len = 1;
bind_ptr->name.ids = mib_ii_name_ptr; // mib_ii_name_ptr should be treated as a weak pointer after this point
bind_list.list = bind_ptr; // bind_ptr should be treated as a weak pointer after this point
bind_list.len = 1;


/*
Expand All @@ -276,16 +273,22 @@ Bool GetLocalChatConnectionAddress(AsciiString serverName, UnsignedShort serverP
*/
while (true) {

if (!SnmpExtensionQueryPtr(SNMP_PDU_GETNEXT, bind_list_ptr, &error_status, &error_index)) {
if (!SnmpExtensionQueryPtr(SNMP_PDU_GETNEXT, &bind_list, &error_status, &error_index)) {
//if (!SnmpExtensionQueryPtr(ASN_RFC1157_GETNEXTREQUEST, bind_list_ptr, &error_status, &error_index)) {
DEBUG_LOG(("SnmpExtensionQuery returned false\n"));
SnmpUtilMemFreePtr(bind_list_ptr);
SnmpUtilMemFreePtr(bind_ptr);
SnmpUtilVarBindListFreePtr(&bind_list);
FreeLibrary(snmpapi_dll);
FreeLibrary(mib_ii_dll);
return(false);
}

bind_ptr = bind_list.list;
if (bind_ptr == NULL) {
DEBUG_LOG(("bind_ptr unexpectedly NULL\n"));
SnmpUtilVarBindListFreePtr(&bind_list);
return false;
}

/*
** If this is something new we aren't looking for then we are done.
*/
Expand Down Expand Up @@ -378,9 +381,7 @@ Bool GetLocalChatConnectionAddress(AsciiString serverName, UnsignedShort serverP
}
}

SnmpUtilMemFreePtr(bind_list_ptr);
SnmpUtilMemFreePtr(bind_ptr);
SnmpUtilMemFreePtr(mib_ii_name_ptr);
SnmpUtilVarBindListFreePtr(bind_list);

DEBUG_LOG(("Got %d connections in list, parsing...\n", connectionVector.size()));

Expand Down