ZeroBox Vulnerability Database

RakNet库的RakPeer.cpp文件中的ProcessOfflineNetworkPacket()函数在处理畸形UDP报文时存在整数下溢漏洞：

bool ProcessOfflineNetworkPacket( const SystemAddress systemAddress, const char *data, const int length, RakPeer *rakPeer, RakNetSmartPtr<RakNetSocket> rakNetSocket, bool *isOfflineMessage, RakNetTimeUS timeRead )
…
    if (length <=2)
    {
        *isOfflineMessage=true;
    }
    …
    if (*isOfflineMessage)
    {
        …
        else if ((unsigned char) data[ 0 ] == ID_OUT_OF_BAND_INTERNAL &&
            (size_t) length < MAX_OFFLINE_DATA_LENGTH+sizeof(OFFLINE_MESSAGE_DATA_ID)+sizeof(MessageID)*2+RakNetGUID::size())
        {
            unsigned int dataLength = (unsigned int) (length-sizeof(OFFLINE_MESSAGE_DATA_ID)-RakNetGUID::size()-sizeof(MessageID)*2);
            RakAssert(dataLength<1024);
            packet=rakPeer->AllocPacket(dataLength+sizeof(MessageID), __FILE__, __LINE__);
            RakAssert(packet->length<1024);
            …
            packet->data[0]=data[1];
            …

length <=2检查要求代码无需执行额外的检查便处理入站的ID_OUT_OF_BAND_INTERNAL报文，但报文大小小于sizeof(OFFLINE_MESSAGE_DATA_ID)-RakNetGUID::size()-sizeof(MessageID)*2)，因此由于这个整数溢出dataLength会过大，packet->data会被AllocPacket设置为空。访问这个空指针会导致使用这个库的游戏服务器或客户端立即崩溃。

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！