cce606764c
Command_DumpZone.number_cards is an unbounded sint32 supplied by the client, and
cmdDumpZone used it as an index without ever putting it in range.
for (int i = 0; (i < cards.size()) && (i < numberCards || numberCards == -1); ++i) {
const auto &findId = cmd.is_reversed() ? cards.size() - numberCards + i : i;
Server_Card *card = cards[findId];
A forward request happened to be safe, because the loop stopped at the zone's own size.
A reversed one was not. number_cards is documented by the client as -1 for "the whole
zone", and cards.size() - numberCards is therefore cardCount + 1, one past the last card.
A request larger than the zone puts the offset at a negative index instead. Both read
out of bounds, then dereference the result as a Server_Card, so either adjacent heap
memory or a crash.
Any player can reach it: the zone only has to be a public one, or the requester's own,
and both number_cards and is_reversed come straight off the wire. A reversed dump of -1
is enough on any public zone with cards in it.
Resolve the request to a half-open span up front. -1 and any positive count are clamped
to what the zone actually holds, any other negative count resolves to nothing, and a
reversed request takes the span from the end rather than computing an offset from a value
that may not be in range. cards.at() then carries the bound as a second line of defence,
and qsizetype keeps the loop and the list's own indexing type aligned.
Also report card_count as the zone's real size. It was
numberCards < cards.size() ? cards.size() : numberCards, which agrees with the zone size
for every request that was in range and reported the client's own oversized number
otherwise. The client uses card_count to draw placeholders when a zone lists no cards, so
overstating it invents cards that were never there.
Put the resolution in its own translation unit. server_abstract_player.cpp refers to the
RNG global that only servatrice's main.cpp defines, so anything linking that object needs
the whole server binary behind it, which is why no test could reach this code before.
server_dump_zone_test covers each request shape and then asserts the span is contained in
[0, cardCount) across the edges of the request domain, INT_MIN and INT_MAX included.
Reverting the arithmetic makes three of them fail, the two out-of-bounds shapes and the
containment sweep.
The client's own copy of this convention at view_zone.cpp:93 already clamps the way this
now does. Leaving that duplication for a follow-up, since the client reaching the same
answer by a different route is not a defect.
Co-authored-by: Lukas Brübach <Bruebach.Lukas@bdosecurity.de>
Cockatrice | Download | Related | Community | Contribute | Build | Run
To get started with Cockatrice ⇢ view our webpage
To get support, or suggest changes to the app ⇢ file an issue (How?) To help with development ⇢ learn how to contribute
Cockatrice
Cockatrice is an open-source, multiplatform application for playing tabletop card games over a network. The program's server design prevents users from manipulating the game for unfair advantage. The client also provides a single-player mode, which allows users to brew while offline.
This project uses C++ and the Qt libraries.
Download 
Downloads are available for stable releases and the current beta version in development.
There is no strict release schedule for either of them.
Latest stable release:
Latest beta version:
While incorporating the latest fixes and features, beta builds may not be stable or contain new bugs! Please report any findings and open new issues when testing them!
Related Repositories
- Magic-Token: File with MtG token data for use in Cockatrice
- Magic-Spoiler: Code to generate MtG spoiler data from MTGJSON for use in Cockatrice
- cockatrice.github.io: Code of the official Cockatrice webpage
- io.github.Cockatrice.cockatrice: Configuration of our Linux
flatpakpackage hosted at Flathub - Webatrice: Web client for Cockatrice servers (TypeScript / React)
Community Resources 
Join our Discord community to connect with other project contributors (#dev channel) or fellow users of the app. Come here to talk about the application, features, or just to hang out.
Important
For support regarding specific servers, please contact that server's admin/mods and use their dedicated communication channels rather than contacting the team building the software.
Contribute
Code | Documentation | Translation
Repository Activity
Code
To contribute code to the project, please review our guidelines first.
We maintain two tags for contributors to easier find issues to potentially work on:
Issues tagged in this way provide a simple way to get started. They don't require much experience to be worked on.
This tag is used for issues that we are looking for somebody to pick up. Often this is for feature suggestions we support, but don't have the time to work on ourselves.
For both tags, we're willing to provide help to contributors in showing them where and how they can make changes, as well as code reviews for submitted changes.
We'll happily advice on how best to implement a feature, or we can show you where the codebase is doing something similar before you get too far along - put a note on an issue you want to discuss more on!
You can also have a look at our Todo List in our Code Documentation or search the repo for \todo comments.
Documentation 
There are various places where useful information for different needs are maintained:
- Official Code Documentation
- Official Wiki
Community supported - Official Webpage
- Official README
This file - Official CONTRIBUTING
Cockatrice tries to use the Google Developer Documentation Style Guide to ensure consistent documentation. We encourage you to improve the documentation by suggesting edits based on this guide.
Translation 
Cockatrice uses Transifex to manage translations. You can help us bring Cockatrice and Oracle to your language and just adjust single wordings right from within your browser by visiting our Transifex project page. The Webatrice web client manages its own translations in its repo.
Check out our Translator FAQ for more information about getting involved, and join a group of hundreds of others!
Build 
Dependencies: (for minimum versions search our CMake file)
Oracle can optionally use some packages to load compressed card files:
Basic compilation steps:
mkdir build
cd build
cmake ..
make
You can then
- Create a Cockatrice installation inside the
releasefolder:make install - Or make an installation package specific to your system:
make package
Note
Detailed compiling instructions can be found in the Cockatrice wiki at Compiling Cockatrice
The following flags (with their non-default values) can be passed to cmake:
| Flag | Description |
|---|---|
-DWITH_SERVER=1 |
Build Servatrice server |
-DWITH_CLIENT=0 |
Don't build Cockatrice client |
-DWITH_ORACLE=0 |
Don't build Oracle card database tool |
-DCMAKE_BUILD_TYPE=Debug |
Compile in debug mode Enables extra logging output, debug symbols, and much more verbose compiler warnings |
-DWARNING_AS_ERROR=0 |
Don't treat compilation warnings as errors in debug mode |
-DUPDATE_TRANSLATIONS=1 |
Configure make to update the translation .ts files for new strings in the source codeNote: make clean will remove the .ts files |
-DTEST=1 |
Enable regression tests Note: make test to run tests, googletest will be downloaded if not available |
Tip
Build code documentation (Doxygen) according to our configuration into
/docs:doxygen Doxyfile
Run
Cockatrice is the game client
Oracle fetches card data
Servatrice is the server
Docker
You can build an image & deploy a Servatrice (Cockatrice server) container using Docker and our Dockerfile yourself.
For more details, look into our wiki section on Setting up Servatrice.
You'll also find more hints on our pre-build image there, or the docker-compose file which will configure and run both a MySQL server and Servatrice.
License 
Cockatrice is free software, licensed under the GPLv2.