LCEMP RCE fixes

Based on commit d017bfc30a68888bf5c79b23cf5c4f607cf828bf
This commit is contained in:
Loki Rautio
2026-03-09 04:45:14 -05:00
parent 0c4f459904
commit d557ca2dfb
27 changed files with 222 additions and 80 deletions

View File

@@ -84,27 +84,56 @@ Tag *Tag::readNamedTag(DataInput *dis)
Tag *Tag::readNamedTag(DataInput *dis, int tagDepth)
{
static __declspec(thread) int depth = 0;
static __declspec(thread) int totalTagCount = 0;
if (depth == 0)
{
totalTagCount = 0;
}
depth++;
if (depth > 256)
{
depth--;
return new EndTag();
}
totalTagCount++;
const int MAX_TOTAL_TAGS = 32768;
if (totalTagCount > MAX_TOTAL_TAGS)
{
depth--;
return new EndTag();
}
byte type = dis->readByte();
if (type == 0) return new EndTag();
if (type == 0) {
depth--;
return new EndTag();
}
// 4J Stu - readByte can return -1, so if it's that then also mark as the end tag
if(type == 255)
{
app.DebugPrintf("readNamedTag read a type of 255\n");
#ifndef _CONTENT_PACKAGE
__debugbreak();
#endif
depth--;
return new EndTag();
}
wstring name = dis->readUTF();//new String(bytes, "UTF-8");
Tag *tag = newTag(type, name);
if (tag == nullptr) {
depth--;
return new EndTag();
}
// short length = dis.readShort();
// byte[] bytes = new byte[length];
// dis.readFully(bytes);
tag->load(dis, tagDepth);
depth--;
return tag;
}