diff --git a/CHANGELOG.md b/CHANGELOG.md index b110aaad..c7a1e596 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -17,6 +17,7 @@ This is the rolling changelog for TShock for Terraria. Use past tense when addin * Added hook `GetDataHandlers.OnNpcTalk` for NpcTalk and a handler for it that stops unregistered and logged out players from interacting with NPCs, preventing them from smuggling or duplicating items via NPC item slots. (@tru321) * Fixed the ability to create custom messages with your death (or the death of another player) (@AgaSpace) * Added the `OnSignRead` handler in `GetDataHandler`, and added the `SignRead` event. Added check to ensure the sign being read is within world bounds `(x >= 0 && y >= 0 && x < Main.maxTilesX && y < Main.maxTilesY)`. (@drunderscore) +* Added check to `HandleNpcTalk` to ensure the passed NPC index is within bounds (>= -1 && < `Main.maxNPCs`). (@drunderscore) ## TShock 4.5.11 * Add the new allowed buff TentacleSpike to NPC buff cheat detection bouncer. (@sgkoishi) diff --git a/TShockAPI/GetDataHandlers.cs b/TShockAPI/GetDataHandlers.cs index 5998ad18..a860596d 100644 --- a/TShockAPI/GetDataHandlers.cs +++ b/TShockAPI/GetDataHandlers.cs @@ -3198,9 +3198,16 @@ namespace TShockAPI TShock.Log.ConsoleDebug("Bouncer / HandleNpcTalk rejected from bouncer throttle from {0}", args.Player.Name); return true; } + + // -1 is a magic value, represents not talking to an NPC + if (npc < -1 || npc >= Main.maxNPCs) + { + TShock.Log.ConsoleDebug("Bouncer / HandleNpcTalk rejected from bouncer out of bounds from {0}", args.Player.Name); + return true; + } return false; - } - + } + private static bool HandlePlayerAnimation(GetDataHandlerArgs args) { if (OnPlayerAnimation(args.Player, args.Data))