LCEMP RCE fixes

Based on commit d017bfc30a68888bf5c79b23cf5c4f607cf828bf
This commit is contained in:
Loki Rautio
2026-03-09 04:45:14 -05:00
parent 0c4f459904
commit d557ca2dfb
27 changed files with 222 additions and 80 deletions

View File

@@ -121,7 +121,20 @@ void TextureAndGeometryPacket::read(DataInputStream *dis) //throws IOException
{
textureName = dis->readUTF();
dwSkinID = static_cast<DWORD>(dis->readInt());
dwTextureBytes = static_cast<DWORD>(dis->readShort());
short rawTextureBytes = dis->readShort();
if (rawTextureBytes <= 0)
{
dwTextureBytes = 0;
}
else
{
dwTextureBytes = (DWORD)(unsigned short)rawTextureBytes;
if (dwTextureBytes > 65536)
{
dwTextureBytes = 0;
}
}
if(dwTextureBytes>0)
{
@@ -134,7 +147,19 @@ void TextureAndGeometryPacket::read(DataInputStream *dis) //throws IOException
}
uiAnimOverrideBitmask = dis->readInt();
dwBoxC = static_cast<DWORD>(dis->readShort());
short rawBoxC = dis->readShort();
if (rawBoxC <= 0)
{
dwBoxC = 0;
}
else
{
dwBoxC = (DWORD)(unsigned short)rawBoxC;
if (dwBoxC > 256)
{
dwBoxC = 0; // sane limit for skin boxes
}
}
if(dwBoxC>0)
{