From 59e0e38d47321bf1825bfaef45140a91f9d91fac Mon Sep 17 00:00:00 2001 From: blattersturm Date: Wed, 6 Sep 2023 23:41:52 +0300 Subject: [PATCH] fix(server/impl): initConnect addition overflow Invalid ticket lengths could lead to an out-of-bounds read. --- code/components/citizen-server-impl/src/InitConnectMethod.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/code/components/citizen-server-impl/src/InitConnectMethod.cpp b/code/components/citizen-server-impl/src/InitConnectMethod.cpp index f0e6ada29d..52fd23d872 100644 --- a/code/components/citizen-server-impl/src/InitConnectMethod.cpp +++ b/code/components/citizen-server-impl/src/InitConnectMethod.cpp @@ -215,7 +215,7 @@ static std::optional VerifyTicketEx(const std::string& ticket) return {}; } - uint32_t length = *(uint32_t*)&ticketData[20 + 4 + 128]; + size_t length = static_cast(*(uint32_t*)&ticketData[20 + 4 + 128]); // validate full length if (ticketData.size() < 20 + 4 + 128 + 4 + length)