TextPacket vulnerabilities

[StefanFox-Dev]

Issue description

• Actual result: crash

Steps to reproduce the issue

1. Turn on the bot through a proxy
2. We go to the server with a proxy
3. We send the package "TextPacket" count message: 99999999999/second.
4. Ready! The server lay down for 30 minutes, nothing works, there is no crash and it will only save reboot VDS

OS and versions

• PocketMine-MP: 0.0.1 - 4.2.9
• PHP: 7.0.1 - 8.0.17
• Using JIT: yes/no
• Server OS: Ubuntu 20.04
• Game version: Android/iOS/Win10/Xbox/PS4/Switch

Plugins

Plugins null.

Crashdump, backtrace or other files

No crash server.

FIX PROBLEM:

`public function onCrashGuard(DataPacketReceiveEvent $ev){

if($ev->getPacket() instanceof TextPacket){ if(mb_strlen($ev->getPacket()->message) > 500){ var_dump(mb_strlen($ev->getPacket()->message)); $ev->getOrigin()->getPlayer()->kick('Off bot please!'); $ev->cancel(); } } }`

BOT:

PROBLEM:

Stupidly the server is frozen, it works everywhere, any server! Therefore, I leaked a fix to you :)

[dktapps]

well done, you just advertised this "vulnerability" to 300 people ...

[StefanFox-Dev]

How else could it be written?

[Nerahikada]

See SECURITY.md

[StefanFox-Dev]

It's clear

[StefanFox-Dev]

Issue description

• Actual result: crash

Steps to reproduce the issue

1. Turn on the bot through a proxy
2. We go to the server with a proxy
3. We send the package "TextPacket" count message: 99999999999/second.
4. Ready! The server lay down for 30 minutes, nothing works, there is no crash and it will only save reboot VDS

OS and versions

• PocketMine-MP: 0.0.1 - 4.2.9
• PHP: 7.0.1 - 8.0.17
• Using JIT: yes/no
• Server OS: Ubuntu 20.04
• Game version: Android/iOS/Win10/Xbox/PS4/Switch

Plugins

Plugins null.

Crashdump, backtrace or other files

No crash server.

FIX PROBLEM:

`public function onCrashGuard(DataPacketReceiveEvent $ev){

if($ev->getPacket() instanceof TextPacket){ if(mb_strlen($ev->getPacket()->message) > 500){ var_dump(mb_strlen($ev->getPacket()->message)); $ev->getOrigin()->getPlayer()->kick('Off bot please!'); $ev->cancel(); } } }`

BOT:

PROBLEM:

Stupidly the server is frozen, it works everywhere, any server! Therefore, I leaked a fix to you :)

[dktapps]

It's too late for that. Anyone receiving email notifications now knows about this problem, as well as anyone paying attention to our Discord server.