From what I have found, the crash results in the closing of the connection if an invalid packet is received.
Code:
if( &pClientSock->m_ovRecv == lpov ) // receive i/o completed
{
CBuffer* pBuffer = pClientSock->Fetch( dwBytes );
if( pBuffer )
{
if( pBuffer->cb > 0 ) {
pBuffer->dpid = hSocket;
pDPSock->m_lspRecvBuffer.AddTail( pBuffer );
SetEvent( pDPSock->GetRecvHandle() );
}
else {
SAFE_DELETE( pBuffer );
}
}
else if( WSAGetLastError()
== ERROR_BAD_NET_NAME )
{
pDPSock->CloseConnection( hSocket );
continue;
}
Found in dpsock.cpp IoWorkerThread
This basically results in the connection being terminated, then the pings going on won't be able to communicate resulting in the "TRANS not alive" or "CORE not alive" errors.
Why a crash happens can have multiple issues. Can't really pinpoint it right now. But basically what could happen is that
Code:
m_pRecvBuffer = CBufferFactory::GetInstance().CreateBuffer( m_nBufferType, uPacketSize );
might cause some memory violation or just returning NULL. If you look at it you'll see that CreateBuffer takes a buffer-type and the packet-size. I don't know if you can somehow manipulate the buffer-type but when actually creating the buffer, there is a check for MAX_BUFFER on the supplied buffer-size. If that fails it's trying to allocate memory on the heap with the supplied buffer-size. So I guess it just busts up the heap rather than dropping the message received.
Code:
CBuffer::CBuffer( u_long uBufSize )
{
if( uBufSize > MAX_BUFFER ) {
m_lpBufStart = (LPBYTE)CBuffer::m_pHeapMng->Malloc( uBufSize );
Since all of this happens as a void* operation, it might as well crash when trying to actually convert the memory data to something it wasn't intended to be.
Those are just some guesses from a quick look at what the code actually does, but I guess debugging will be your best bet to see if it actually crashes on the error or tries to do something else, in which case it would be easier to pinpoint where the exploit is coming from.
Because in theory, the packet has to get corrupted somewhere along the way on a message received from probably cache or worldserver.
If the program just shuts down without throwing an error message or an exception, I would suppose it's this part:
Code:
fOk = GetQueuedCompletionStatus( pDPSock->GetCompletionPort( lIoWorker - 1 ), &dwBytes, (LPDWORD)&hSocket, &lpov, INFINITE );
if( dwBytes == CLOSEIOWORKERMSG )
{
InterlockedDecrement( &pDPSock->m_lActiveIoWorker );
return( 0 );
}
So basically someone is sending the exact package to turn off the instance. But that's some WinAPI stuff I'm not really familiar with.
