themaster1970sf/TShock
1
0
Fork 0
Code Issues Pull requests Projects Releases 1 Packages Wiki Activity Actions

Merge pull request #2933 from punchready/patch-2

Browse source 
Update STR handling to reject for-sure invalid framing values
This commit is contained in:
Chris 2023-03-25 16:52:51 +10:30 • committed by GitHub
commit 01b8e521f7
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 34 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

33
TShockAPI/Handlers/SendTileRectHandler.cs
View file

@ -181,6 +181,7 @@ namespace TShockAPI.Handlers
} }
NetTile newTile = tiles[x, y]; NetTile newTile = tiles[x, y];
TileObjectData data; TileObjectData data;
// If the new tile has an associated TileObjectData object, we take the tile and the surrounding tiles that make up the tile object // If the new tile has an associated TileObjectData object, we take the tile and the surrounding tiles that make up the tile object
@ -218,10 +219,26 @@ namespace TShockAPI.Handlers
case TileID.ShimmerMonolith: case TileID.ShimmerMonolith:
{ {
// Allowed changes // Allowed changes
// Based on empirical tests, these should be some conservative upper bounds for framing values
if (newTile.FrameX != -1 || newTile.FrameY != -1)
{
if (newTile.FrameX is < 0 or > 1000)
{
processed[x, y] = true;
continue;
}
if (newTile.FrameY is < 0 or > 5000)
{
processed[x, y] = true;
continue;
}
}
} }
break; break;
default: default:
{ {
processed[x, y] = true;
continue; continue;
} }
} }
@ -241,10 +258,26 @@ namespace TShockAPI.Handlers
case TileID.TargetDummy: case TileID.TargetDummy:
{ {
// Allowed placements // Allowed placements
// Based on empirical tests, these should be some conservative upper bounds for framing values
if (newTile.FrameX != -1 || newTile.FrameY != -1)
{
if (newTile.FrameX is < 0 or > 1000)
{
processed[x, y] = true;
continue;
}
if (newTile.FrameY is < 0 or > 500)
{
processed[x, y] = true;
continue;
}
}
} }
break; break;
default: default:
{ {
processed[x, y] = true;
continue; continue;
} }
} }

1
docs/changelog.md
View file

@ -109,6 +109,7 @@ Use past tense when adding new entries; sign your name off when you add or chang
* Relaxed custom death message restrictions to allow Inferno potions in PvP. (@drunderscore) * Relaxed custom death message restrictions to allow Inferno potions in PvP. (@drunderscore)
* Allowed Flower Boots to place Ash Flowers on Ash Grass blocks. (@punchready) * Allowed Flower Boots to place Ash Flowers on Ash Grass blocks. (@punchready)
* Removed unnecessary range check that artifically shortened quick stack reach. (@boddyn, #2885, @bcat) * Removed unnecessary range check that artifically shortened quick stack reach. (@boddyn, #2885, @bcat)
* Improved the exploit protection in tile rect handling. (@punchready)
## TShock 5.1.3 ## TShock 5.1.3
* Added support for Terraria 1.4.4.9 via OTAPI 3.1.20. (@SignatureBeef) * Added support for Terraria 1.4.4.9 via OTAPI 3.1.20. (@SignatureBeef)