Skip to content

Add size validation for OP_SERVERMESSAGE packets - #447

Merged
mrjimenez merged 1 commit into
amule-project:masterfrom
lggcs:master
Apr 15, 2026
Merged

Add size validation for OP_SERVERMESSAGE packets#447
mrjimenez merged 1 commit into
amule-project:masterfrom
lggcs:master

Conversation

@lggcs

@lggcs lggcs commented Apr 15, 2026

Copy link
Copy Markdown

Prevent out-of-bounds read when processing server messages 4 with size < 3, which would cause underflow on the buffer 5 allocation (size-1) and invalid memcpy from packet[2].

Resolves #445

Prevent out-of-bounds read when processing server messages 4 with size < 3, which would cause underflow on the buffer 5 allocation (size-1) and invalid memcpy from packet[2].

Resolves amule-project#445
@mrjimenez
mrjimenez merged commit 2ca5f40 into amule-project:master Apr 15, 2026
2 checks passed
got3nks added a commit to got3nks/amule that referenced this pull request Jul 11, 2026
…e-project#431) (amule-project#447)

Collapse hits that are the same file (same ed2k hash AND size) but
advertised under different filenames into one expandable parent row,
end to end, and let a chosen alternative name be downloaded.

Phase 1 - expose grouping:
- Core (ExternalConn.cpp): the EC_DETAIL_FULL search responder now
  descends into GetChildren() and emits each child when the caller opts
  in with an empty EC_TAG_SEARCH_PARENT flag on the request. amulecmd /
  amuleweb don't send it, so their flat parents-only list is unchanged;
  the INC_UPDATE (amulegui) path already emitted children. Children
  carry their parent's ECID via EC_TAG_SEARCH_PARENT (already in
  CEC_SearchFile_Tag).
- webapi: RefresherTick sends the flag; ApplySearchFull reads
  EC_TAG_SEARCH_PARENT and folds children into the parent's children[]
  (name/hash/ecid/sources), dropping them from the top-level set;
  WriteSearchObject + the search_result_added SSE emit children[]
  (always present, empty for a single-name hit).

Phase 2 - download under a chosen name:
- Since grouped children share the parent's hash, hash alone can't pick
  one. POST /search/results/{hash}/download takes an optional "ecid"
  (a child's ECID) that rides as an EC_TAG_SEARCHFILE selector;
  CSearchList::AddFileToDownloadByEcid resolves it across parents +
  children and downloads that specific result, so the partfile lands
  under the chosen filename. Omitted => the parent, unchanged.
- The download responder now reads the category by name
  (EC_TAG_PARTFILE_CAT) so the ecid selector can ride alongside it.

RefresherTest.SearchResultGroupingFoldsChildren; curl 19 children[]
shape + ecid 400; REST + SSE docs. Verified live on a connected daemon
(search 'euphoria': 3 grouped parents / 6 children; download 202,
ecid-type 400). Frontend rendering is deliberately out of scope.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Heap Buffer Overflow in OP_SERVERMESSAGE Handler

2 participants