#######################################################################

                         Luigi Auriemma

Application: Warzone Resurrection
http://home.gna.org/warzone/
(Warzone 2100 http://www.strategyplanet.com/warzone2100/)
Versions: <= 2.0.3 and SVN <= 127
Platforms: Windows, *nix, *BSD and others
Bug: A] buffer-overflow in recvTextMessage
B] buffer-overflow in NETrecvFile
Exploitation: A] remote, versus server
B] remote, versus client
Date: 22 Jul 2006
Author: Luigi Auriemma
e-mail: [email protected]
web: aluigi.org

#######################################################################

1) Introduction
2) Bug
3) The Code
4) Fix

#######################################################################

===============
1) Introduction

Warzone 2100 is a well known commercial game developed by Pumpkin
Studios and released under the GPL license at the end of 2004.
Warzone Resurrection is the project which continues the development and
the maintaining of this game.

#######################################################################

======
2) Bug

---

A] buffer-overflow in recvTextMessage

recvTextMessage is the function used by the server for handling the
text messages sent by the clients.
This function uses the msg buffer, which has a size of 256
(MAX_CONSOLE_STRING_LENGTH) bytes, for containing the entire message to
send to all the other clients using the following format:

player_name : message

The size of the data block can be max 8000 (MaxMsgSize) bytes so an
attacker can cause a buffer-overflow for crashing the server or
executing malicious code.

>From src/multiplay.c:

BOOL recvTextMessage(NETMSG *pMsg)
{
DPID dpid;
UDWORD i;
STRING msg[MAX_CONSOLE_STRING_LENGTH];

NetGet(pMsg,0,dpid);
for(i = 0; NetPlay.players[i].dpid != dpid; i++);

//findplayer

strcpy(msg,NetPlay.players[i].name);

// name
strcat(msg," : ");
// seperator
strcat(msg, &(pMsg->body[4]));
…

---

B] buffer-overflow in NETrecvFile

The NETrecvFile function used by the clients for downloading remote
files is affected by a buffer-overflow caused by the copying of a
string of max 255 bytes in the fileName buffer of only 128 bytes.

>From lib/netplay/netplay.c:

UBYTE NETrecvFile(NETMSG *pMsg)
{
UDWORD pos, fileSize, currPos, bytesRead;
char fileName[128];
unsigned int len;
static PHYSFS_file *pFileHandle;

//read incoming bytes.
NetGet(pMsg,0,fileSize);
NetGet(pMsg,4,bytesRead);
NetGet(pMsg,8,currPos);

// read filename
len = (unsigned int)(pMsg->body[12]);
memcpy(fileName,&(pMsg->body[13]),len);
...

#######################################################################

===========
3) The Code

A]
modify sendTextMessage using a message of more than 256 bytes

B]
modify sendMap using a map of more than 128 bytes

#######################################################################

======
4) Fix

SVN 128

#######################################################################

---

Luigi Auriemma
http://aluigi.org
http://mirror.aluigi.org