Skip to content

fix: silently drop short GS4 query datagrams - #1857

Open
bejiihiu wants to merge 1 commit into
PaperMC:dev/4.0.0from
bejiihiu:fix/gs4-short-datagram
Open

fix: silently drop short GS4 query datagrams#1857
bejiihiu wants to merge 1 commit into
PaperMC:dev/4.0.0from
bejiihiu:fix/gs4-short-datagram

Conversation

@bejiihiu

Copy link
Copy Markdown
Contributor

Fixes #1828.

GameSpyQueryHandler.channelRead0 reads magic bytes, type, and sessionId without first checking readableBytes(). A malformed UDP datagram shorter than 7 bytes throws IndexOutOfBoundsException on every packet, caught and logged at WARNING:

Error whilst handling query packet from

Fix:

  • Added MINIMUM_MESSAGE_LENGTH (7) — a named constant with javadoc explaining the 2+1+4 byte layout and which handler branch reads the shortest valid message (QUERY_TYPE_HANDSHAKE).
  • Silently drop any datagram shorter than MINIMUM_MESSAGE_LENGTH before touching any byte.
  • Also guard the challenge-token read in the QUERY_TYPE_STAT branch (4 bytes after the 7-byte header) for defence-in-depth — a 7-byte datagram with type 0x00 would pass the header check but fail on the readInt() for the challenge token.

Test coverage:

  • Short/empty datagrams are silently dropped (no exception)
  • 7-byte STAT datagram without challenge token is silently dropped (no exception)

Validation:

  • ./gradlew :velocity-proxy:check — checkstyle, spotless, and all tests pass

GameSpyQueryHandler.channelRead0 reads magic bytes, type, and sessionId
without checking readableBytes first. A malformed UDP datagram shorter
than 7 bytes throws IndexOutOfBoundsException, spamming the log.

Adds MINIMUM_MESSAGE_LENGTH constant (7) with a readable guard at the
top of channelRead0. Also guards the challenge-token read in the STAT
branch (4 bytes after the 7-byte header) for defence in depth.

Fixes PaperMC#1828
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

GS4 query handler throws on short/malformed datagrams instead of dropping them

1 participant