From 49d31b18dbdd8f4b84c29597ea4488bf4e64d54e Mon Sep 17 00:00:00 2001 From: Fletcher Dunn Date: Thu, 29 Aug 2024 16:56:57 -0700 Subject: [PATCH] Fix bug not properly detecting an invalid stop_waiting value. P4:9130151 --- .../clientlib/steamnetworkingsockets_snp.cpp | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/src/steamnetworkingsockets/clientlib/steamnetworkingsockets_snp.cpp b/src/steamnetworkingsockets/clientlib/steamnetworkingsockets_snp.cpp index 2709eb5..305ff47 100644 --- a/src/steamnetworkingsockets/clientlib/steamnetworkingsockets_snp.cpp +++ b/src/steamnetworkingsockets/clientlib/steamnetworkingsockets_snp.cpp @@ -989,12 +989,18 @@ bool CSteamNetworkConnectionBase::ProcessPlainTextDataChunk( int usecTimeSinceLa case 2: READ_24BITU( nOffset, szStopWaitingOffset ); break; case 3: READ_64BITU( nOffset, szStopWaitingOffset ); break; } - if ( nOffset >= nPktNum ) + ++nOffset; + int64 nMinPktNumToSendAcks = nPktNum-nOffset; + + // Make sure the resulting stop value makes sense. + // Force the use of an unsigned comparison, since a negative stop value + // is also illegal. That would be rejected below, but rejecting it here + // is clearer. + if ( (uint64)nMinPktNumToSendAcks >= (uint64)nPktNum ) { DECODE_ERROR( "stop_waiting pktNum %llu offset %llu", nPktNum, nOffset ); } - ++nOffset; - int64 nMinPktNumToSendAcks = nPktNum-nOffset; + if ( nMinPktNumToSendAcks == m_receiverState.m_nMinPktNumToSendAcks ) continue; if ( nMinPktNumToSendAcks < m_receiverState.m_nMinPktNumToSendAcks )