[quakenet] <Teeworlds> [teeworlds] oy closed pull request #1997: No longer incorrectly show bot servers when 'Has people playing' and 'Hide bots' are ticked (master...fix-nonemptyfilter) https://git.io/fho2V
[quakenet] <Teeworlds> [teeworlds] oy closed pull request #2001: Add check before resetting the local rcon map list (master...fix-maplist-crash) https://git.io/fh6t3
[quakenet] <koomi> fwiw I used afl and adapted net_udp_recv to read input from stdin
20:53
[quakenet] <heinrich5991> ddnet fuzzed it a bit as well
20:53
[quakenet] <heinrich5991> you might want to disable compression
20:53
[quakenet] <heinrich5991> (and fuzz that separately if you want)
20:54
[quakenet] <heinrich5991> the reading of datafiles (maps) is completely broken in that respect. no checks whatsoever and all offsets read from the file are trusted
20:54
[quakenet] <minus> =D
20:55
[quakenet] <heinrich5991> (I read through that code thoroughly while writing the rust datafile & map library)
20:55
[quakenet] <koomi> right, good point, but I don't think I'll spend time on it anytime soon
20:56
[quakenet] <minus> can we get a RCE via map download PoC?
20:58
[quakenet] <heinrich5991> unlikely
20:58
[quakenet] <heinrich5991> I tried to estimate the impact back then
20:58
[quakenet] <heinrich5991> it looked like DoS only
20:58
[quakenet] <heinrich5991> you only get arbitrary reads, and since the only thing the client sends to the server is the input, you can't even extract useful data
21:04
[quakenet] <koomi> maybe you can figure out the rcon password
21:05
[quakenet] <heinrich5991> the server sends maps to the client, so the only information you could possibly extract is information the client has
21:06
[quakenet] <koomi> oh right, wrong way
21:06
[quakenet] <koomi> the server doesn't parse maps that it serves?
21:06
[quakenet] <heinrich5991> it does
21:06
[quakenet] <heinrich5991> but only the server admin can put maps there
21:07
[quakenet] <heinrich5991> hmmmm
21:07
[quakenet] <koomi> yeah, race servers have lots of maps from various people though
21:07
[quakenet] <heinrich5991> yeah
21:07
[quakenet] <TeeSlayer> who wants to try zcatch on 0.7? :)
21:07
[quakenet] <heinrich5991> ok, the only way the server uses the map data is via the game layer
21:08
[quakenet] <heinrich5991> so one could theoretically try to carefully craft a map which uses the game layer to transport information to the client
21:08
[quakenet] <heinrich5991> (while at the same time looking legitimate, that part might be hard)
21:09
[quakenet] <heinrich5991> well, there are probably services that allow you to upload arbitrary maps, so that part might be optional
21:09
[quakenet] <TeeSlayer> yeah, I've seen that
21:09
[quakenet] <TeeSlayer> but only for 0.6
21:09
[quakenet] <TeeSlayer> I thought about doing sth like that, but not anymore :D
21:10
[quakenet] <koomi> TeeSlayer: laser zcatch?
21:10
[quakenet] <TeeSlayer> ofc
21:10
[quakenet] <TeeSlayer> ctf4_old
21:10
[quakenet] <koomi> let me search for a mouse
21:12
[quakenet] <TeeSlayer> the only problem is that the old zcatch converted players to spectator, so it might confuse people in the server browser
21:12
[quakenet] <TeeSlayer> I need to change that, but not today^^
21:13
[quakenet] <heinrich5991> you could theoretically still change them to spectators but report something different
21:13
[quakenet] <heinrich5991> actually, this sounds like it might be a good application for the client's support for the survival mode
21:14
[quakenet] <koomi> found a mouse, now making space on the desk...
21:14
[quakenet] <TeeSlayer> nice
21:15
[quakenet] <heinrich5991> I guess I'll get a mouse as well
21:16
[quakenet] <TeeSlayer> I hope there won't be any bugs :D
21:17
[quakenet] <koomi> ugh I need to install 0.7 first
21:17
[quakenet] <koomi> oh it's in backports
21:17
[quakenet] <TeeSlayer> that's the point
21:17
[quakenet] <koomi> done
21:17
[quakenet] <koomi> ok I'm all set up
21:18
[quakenet] <TeeSlayer> just search for zcatch
21:20
[quakenet] <koomi> wtf, client freezes for a few seconds as soon as I move my mouse...
21:20
[quakenet] <koomi> but only with the usb mouse, not the laptops built in
21:22
[quakenet] <Teeworlds> [teeworlds] nheir opened pull request #2002: check if whisper message has a valid target (master...fix_whisper) https://git.io/fh6Nv
[quakenet] <day> almost like you get score points for spending time in the game :D
21:51
[quakenet] <heinrich5991> day: ah, I think the issue is that you only see the kills and deaths reflected in the scoreboard that happened while you were on the server
21:51
[quakenet] <heinrich5991> there is an issue about that
21:51
[quakenet] <day> ah
21:51
[quakenet] <heinrich5991> (but the total score is still calculated the same as far as I could gather from the source)
21:51
[quakenet] <day> yeah looks about right. im sure i killed myself a few times
