Skip to content

Guard recursive Lua table bitstream reads #4798

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
qaisjp merged 2 commits into from
Apr 12, 2026
Merged

Guard recursive Lua table bitstream reads #4798

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a726cb2
Guard recursive Lua table bitstream reads
Zephkek Apr 12, 2026
c0d81b4
Run clang-format
qaisjp Apr 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions Client/mods/deathmatch/logic/lua/CLuaArgument.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -468,7 +468,7 @@ void CLuaArgument::Push(lua_State* luaVM, CFastHashMap<CLuaArguments*, int>* pKn
}

// Can't use bitStream.Version() here as it is sometimes not set
bool CLuaArgument::ReadFromBitStream(NetBitStreamInterface& bitStream, std::vector<CLuaArguments*>* pKnownTables)
bool CLuaArgument::ReadFromBitStream(NetBitStreamInterface& bitStream, std::vector<CLuaArguments*>* pKnownTables, unsigned int uiDepth)
{
DeleteTableData();
m_iType = LUA_TNIL;
Expand Down Expand Up @@ -530,7 +530,7 @@ bool CLuaArgument::ReadFromBitStream(NetBitStreamInterface& bitStream, std::vect
case LUA_TTABLE:
{
m_pTableData = new CLuaArguments();
if (!m_pTableData->ReadFromBitStream(bitStream, pKnownTables))
if (!m_pTableData->ReadFromBitStream(bitStream, pKnownTables, uiDepth + 1))
{
DeleteTableData();
return false;
Expand Down
2 changes: 1 addition & 1 deletion Client/mods/deathmatch/logic/lua/CLuaArgument.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,7 +62,7 @@ class CLuaArgument
CLuaArguments* GetTable() const { return m_pTableData; }
CClientEntity* GetElement() const;

bool ReadFromBitStream(NetBitStreamInterface& bitStream, std::vector<CLuaArguments*>* pKnownTables = NULL);
bool ReadFromBitStream(NetBitStreamInterface& bitStream, std::vector<CLuaArguments*>* pKnownTables = NULL, unsigned int uiDepth = 0);
bool WriteToBitStream(NetBitStreamInterface& bitStream, CFastHashMap<CLuaArguments*, unsigned long>* pKnownTables = NULL) const;
json_object* WriteToJSONObject(bool bSerialize = false, CFastHashMap<CLuaArguments*, unsigned long>* pKnownTables = NULL);
bool ReadFromJSONObject(json_object* object, std::vector<CLuaArguments*>* pKnownTables = NULL);
Expand Down
5 changes: 4 additions & 1 deletion Client/mods/deathmatch/logic/lua/CLuaArguments.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -460,8 +460,11 @@ void CLuaArguments::ValidateTableKeys()
}
}

bool CLuaArguments::ReadFromBitStream(NetBitStreamInterface& bitStream, std::vector<CLuaArguments*>* pKnownTables)
bool CLuaArguments::ReadFromBitStream(NetBitStreamInterface& bitStream, std::vector<CLuaArguments*>* pKnownTables, unsigned int uiDepth)
{
if (uiDepth > MaxBitStreamTableReadDepth)
return false;

bool bKnownTablesCreated = false;
if (!pKnownTables)
{
Expand Down
4 changes: 3 additions & 1 deletion Client/mods/deathmatch/logic/lua/CLuaArguments.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,8 @@ class CLuaArguments;
class CLuaArguments
{
public:
static constexpr unsigned int MaxBitStreamTableReadDepth = 64;

CLuaArguments() {}
CLuaArguments(const CLuaArguments& Arguments, CFastHashMap<CLuaArguments*, CLuaArguments*>* pKnownTables = NULL);
CLuaArguments(NetBitStreamInterface& bitStream, std::vector<CLuaArguments*>* pKnownTables = NULL);
Expand Down Expand Up @@ -67,7 +69,7 @@ class CLuaArguments
void DeleteArguments();
void Pop();

bool ReadFromBitStream(NetBitStreamInterface& bitStream, std::vector<CLuaArguments*>* pKnownTables = NULL);
bool ReadFromBitStream(NetBitStreamInterface& bitStream, std::vector<CLuaArguments*>* pKnownTables = NULL, unsigned int uiDepth = 0);
bool WriteToBitStream(NetBitStreamInterface& bitStream, CFastHashMap<CLuaArguments*, unsigned long>* pKnownTables = NULL) const;
void ValidateTableKeys();
bool ReadFromJSONString(const char* szJSON);
Expand Down
4 changes: 2 additions & 2 deletions Server/mods/deathmatch/logic/lua/CLuaArgument.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -435,7 +435,7 @@ bool CLuaArgument::GetAsString(SString& strBuffer)
}

// Can't use bitStream.Version() here as it is sometimes not set
bool CLuaArgument::ReadFromBitStream(NetBitStreamInterface& bitStream, std::vector<CLuaArguments*>* pKnownTables)
bool CLuaArgument::ReadFromBitStream(NetBitStreamInterface& bitStream, std::vector<CLuaArguments*>* pKnownTables, unsigned int uiDepth)
{
DeleteTableData();
m_iType = LUA_TNIL;
Expand Down Expand Up @@ -494,7 +494,7 @@ bool CLuaArgument::ReadFromBitStream(NetBitStreamInterface& bitStream, std::vect
case LUA_TTABLE:
{
m_pTableData = new CLuaArguments();
if (!m_pTableData->ReadFromBitStream(bitStream, pKnownTables))
if (!m_pTableData->ReadFromBitStream(bitStream, pKnownTables, uiDepth + 1))
{
DeleteTableData();
return false;
Expand Down
2 changes: 1 addition & 1 deletion Server/mods/deathmatch/logic/lua/CLuaArgument.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,7 +62,7 @@ class CLuaArgument
CElement* GetElement() const;
bool GetAsString(SString& strBuffer);

bool ReadFromBitStream(NetBitStreamInterface& bitStream, std::vector<CLuaArguments*>* pKnownTables = NULL);
bool ReadFromBitStream(NetBitStreamInterface& bitStream, std::vector<CLuaArguments*>* pKnownTables = NULL, unsigned int uiDepth = 0);
bool WriteToBitStream(NetBitStreamInterface& bitStream, CFastHashMap<CLuaArguments*, unsigned long>* pKnownTables = NULL) const;
json_object* WriteToJSONObject(bool bSerialize = false, CFastHashMap<CLuaArguments*, unsigned long>* pKnownTables = NULL);
bool ReadFromJSONObject(json_object* object, std::vector<CLuaArguments*>* pKnownTables = NULL);
Expand Down
5 changes: 4 additions & 1 deletion Server/mods/deathmatch/logic/lua/CLuaArguments.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -528,8 +528,11 @@ void CLuaArguments::ValidateTableKeys()
}
}

bool CLuaArguments::ReadFromBitStream(NetBitStreamInterface& bitStream, std::vector<CLuaArguments*>* pKnownTables)
bool CLuaArguments::ReadFromBitStream(NetBitStreamInterface& bitStream, std::vector<CLuaArguments*>* pKnownTables, unsigned int uiDepth)
{
if (uiDepth > MaxBitStreamTableReadDepth)
return false;

bool bKnownTablesCreated = false;
if (!pKnownTables)
{
Expand Down
4 changes: 3 additions & 1 deletion Server/mods/deathmatch/logic/lua/CLuaArguments.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,8 @@ class CLuaArguments;
class CLuaArguments
{
public:
static constexpr unsigned int MaxBitStreamTableReadDepth = 64;

CLuaArguments() {}
CLuaArguments(const CLuaArguments& Arguments, CFastHashMap<CLuaArguments*, CLuaArguments*>* pKnownTables = NULL);

Expand Down Expand Up @@ -89,7 +91,7 @@ class CLuaArguments
void ValidateTableKeys();
void Pop();

bool ReadFromBitStream(NetBitStreamInterface& bitStream, std::vector<CLuaArguments*>* pKnownTables = NULL);
bool ReadFromBitStream(NetBitStreamInterface& bitStream, std::vector<CLuaArguments*>* pKnownTables = NULL, unsigned int uiDepth = 0);
bool ReadFromJSONString(const char* szJSON);
bool WriteToBitStream(NetBitStreamInterface& bitStream, CFastHashMap<CLuaArguments*, unsigned long>* pKnownTables = NULL) const;
bool WriteToJSONString(std::string& strJSON, bool bSerialize = false, int flags = JSON_C_TO_STRING_PLAIN);
Expand Down
Loading