vec2 TrollPos = vec2(-100000000, -100000000); // -3.125.000 ingame
pCharacter->m_X = TrollPos.x;
pCharacter->m_Y = TrollPos.y;
Type
unpacked from the snapshot delta is stored in m_SnapshotCurrent
, which is validated to be in range 0 - 0xffff
, but the arrays m_aSnapshotDataUpdates
and m_aSnapshotDataRate
being index with this are sized 1 to small with length 0xffff
. Hence, snapshot deltas with Type == 0xffff
cause OOB accesses.
This is fixed by adding validation for Type
to be in range 0 - CSnapshot::MAX_TYPE
(0x7fff
) and changing the lengths of the arrays to CSnapshot::MAX_TYPE + 1
. Valid...gfx_screen_height
resets to 1421, despite the value 1440 in settings_ddnet.cfg