search

VazkiiMods / Psi

Spellcrafting mod for Minecraft based around Vector math and stack-based processing
http://psi.vazkii.net
314 stars 89 forks source link

Patched potion strength int overflow bug #781

Closed jumble closed 1 year ago

jumble commented 1 year ago

An oversight in PieceTrickPotionBase allowed int overflows to occur, permitting the construction of spells with no cost and insane power. One such spell is the following:

{spellName:"Unholy Strength",uuidMost:-7266359412638333394L,validSpell:1b,spellList:[{data:{key:"constantNumber",constantValue:"1"},x:3,y:2},{data:{key:"constantNumber",constantValue:"1678"},x:3,y:4},{data:{key:"constantNumber",constantValue:"21"},x:3,y:5},{data:{params:{_power:4,_time:3,_target:2},key:"trickStrength"},x:4,y:2},{data:{key:"selectorCaster"},x:4,y:3},{data:{params:{_power:4,_time:3,_target:1},key:"trickStrength"},x:4,y:4},{data:{params:{_power:4,_time:3,_target:2},key:"trickStrength"},x:4,y:5},{data:{key:"selectorCaster"},x:4,y:6},{data:{key:"constantNumber",constantValue:"754"},x:5,y:2},{data:{params:{_power:1,_time:2,_target:3},key:"trickStrength"},x:5,y:3},{data:{key:"constantNumber",constantValue:"1"},x:5,y:4},{data:{key:"constantNumber",constantValue:"43"},x:5,y:5},{data:{key:"errorSuppressor"},x:5,y:6}],uuidLeast:-7744291466539020531L}

It is possible to use this exploit for all potion effects, even multiple in the same spell simultaneously.

This patch fixes PieceTrickPotionBase and makes PieceTrick's safe multiplication utility function more resilient to reduce the likelihood of future development / addons running into this again.

This bug may be present in other versions of the mod- I haven't checked.