Hack Fixes(Including Dupe Hack)

[xMootie]

Some guy from AscensionFlyff thought he would go around trying to start server wars or something. Used a dupe exploit in the Flyff source(wasn't too hard to find). Here's the fix for it since he lied to me about the exploit being in my code.

Dupe Fix:

Both of these fixes are in world server.

File: DPSrvr.cpp, Function - CDPSrvr::OnPutItemGuildBank:
Change

DWORD nItemNum;

to

int nItemNum;

File: DPSrvr.cpp, Function - CDPSrvr::OnGetItemGuildBank:
Change

DWORD dwItemNum;

to

int dwItemNum;

Dupe fixed.

I'll update this if he uses any more exploits on my server.

Update - Dupe explanation I posted on another forum:

Ok... I thought this was pretty obvious but let me try to explain.

signed int32 max(int) = -2147483647 to 2147483647
unsigned int32 max(DWORD) = 0 to 4294967295

When you cast an unsigned integer to a signed integer and it exceeds the maximum range, you get an integer overflow. The value then goes negative. So, let's try the following code.

DWORD dwItemNum = 2147483648;
int nItemNum = (int)dwItemNum;

nItemNum would now be -2147483549(since it exceeded the limit).

So lets take a look at this range check in the DPSrvr.cpp file.

if( (int)( dwItemNum ) > pItemElem->m_nItemNum )
	dwItemNum = pItemElem->m_nItemNum;
if( dwItemNum < 1 )
	dwItemNum	= 1;

Guess what this translates to if I send a packet with a value of 2147483747(100 more than the signed int32 max)?

if( -2147483549 > pItemElem->m_nItemNum )
	dwItemNum = pItemElem->m_nItemNum;
if( 2147483747 < 1 )
	dwItemNum	= 1;

It passes both checks, then we later see...

CItemElem itemElem;
itemElem	= *pItemElem;
itemElem.m_nItemNum		= (short)( dwItemNum );
itemElem.m_dwObjId		= pItemElem->m_dwObjId;

->

CItemElem itemElem;
itemElem	= *pItemElem;
itemElem.m_nItemNum		= (short)( -2147483549 ); // 99
itemElem.m_dwObjId		= pItemElem->m_dwObjId;

Say we had a twinklestone(1x) in the guild bank and we sent a packet with the item number set to 2147483747? We now have 99 twinklestones in our inventory.