[fixed] Massive Disconnect (fatal error) with a channel message.

[Micks]

Hello all,

Anyone know any way to send a message in a custom channel, and give fatal error into client of all the players in this channel?

I am suffering these attacks a few days ago, some players create level 1 chars and join in my custom channel, ex: /join global. And sending a message that gives fatal error on everyone in the channel at that time.

I activated a patch "Lexic Cutter" and I'm monitoring these channels. a message that knocked the players was this:

[Adaduhiaudhd]->CHANNEL:[global] |cffffff00|Hquest:24919|h[The Lightbringer's Redemption]|h|r

And all players get "fatal error".

I've tried to protect me in many ways, nothing worked.

Is there any way that anyone knows? Or block access to these channels by level?

[Senpuria]

Until you find more information on how these attacks work, I'd suggest disabling custom channels. Having custom channels is not worth repeated attacks causing disconnections.

If you know the core well, you MIGHT be able to write something blocking access to custom channels by level, however if people still want to attack the server using that exploit, I'm quite sure they would take the time to level up, just to attack it.

Take a look at the quest, try doing the quest and see if there's any point in the quest if you logged out at a certain point it would force disconnect users, I wouldn't see this to be the case but its worth a try.

[Micks]

I'm still doing some testing and I think they use some script like:

/run if(not scm) then scm = SendChatMessage; end; function SendChatMessage(msg, type, lang, chan) scm("\\124cffff0000 \\124Hitem:19:0:0:0:0:0:0:0\\124h" ..msg.."\\124h\\124r", type, lang, chan);end;

and link quests to make client fatal error.

But I'm still can not reproduce any errors in mass.

Is there any way to easily disable these scripts (run)?

I tried putting a restriction level for join in custom channels, but could not.

[Patman128]

No, you can't disable client side scripts.

[Lugia0529]

I'm still doing some testing and I think they use some script like:

/run if(not scm) then scm = SendChatMessage; end; function SendChatMessage(msg, type, lang, chan) scm("\\124cffff0000 \\124Hitem:19:0:0:0:0:0:0:0\\124h" ..msg.."\\124h\\124r", type, lang, chan);end;

and link quests to make client fatal error.

But I'm still can not reproduce any errors in mass.

Is there any way to easily disable these scripts (run)?

I tried putting a restriction level for join in custom channels, but could not.

Just try to modify your script a bit and it seem player who can see that message have a client crash after the message is send.

Don't know is that i'm allow to post that script here because it may cause many player use script to crash others.

I am from malaysia, so my english is a bit poor.

[Prof.João]

The May attacks and use any types of communication channels (also whispering). Block Unnecessary use of any scripts According to GM LEVEL Perhaps an interim measure would Until a more effective solution or method of attack is Discovered Before It Can Be Analyzed, any programmer Can Tell me if this is possible (blocking the scripts)? or Have a more effective solution?

Sorry for my Bad English.Grateful now.

[Lugia0529]

In my opinion i think that is because we force a color text on quest link while some player may enable quest difficulty color option in interface setting. As I remember a quest link will generate a text color according to player level if the player enable that option, if not the quest link will show in yellow color. So the client cant handle it and get a fatal error.

[Micks]

I will try to enable this option.

But I am depending on being attacked to know if it worked. hehehehe

[Lugia0529]

OK, I just try at my server and i think that option do nothing in this problem.

Client who receive that message get an Error: #134 message and close after that, don't know your case is same to me.

The player who send the message will also get a client crash after he send that message.

I have try using whisper, guild, say, yell (I have modify the Player::Yell and my yell is a world chat channel, and the test crash all my player's client.) channel to send that message, and very sure that only player receive that message have a client crash.

This is just a small test and may not accurate or may not your scenario, but I hope this can help you.^^

[VladimirMangos]

Just try to modify your script a bit and it seem player who can see that message have a client crash after the message is send.

Don't know is that i'm allow to post that script here because it may cause many player use script to crash others.

Can you send it to my PM for testing?

[Lugia0529]

Can you send it to my PM for testing?

I PM you already

[Prof.João]

the script that generates the crash was found, but it is risky to post in open forum , the script generates the crash will be sent to Vladimir in PM , I believe the answer comes soon in Open Forum

[Micks]

Prof.João has reproduced fatal error just as we were being attacked.

One MP has already been sent to Vladimir. Thank you to everyone who responded to the topic.

[VladimirMangos]

Thank you for test cases! Must be fixed in [11321] with ChatStrictLinkChecking.Severity = 3

[Prof.João]

The patch works but only gmlevel = 0, other levels the crash is working.

[Aokromes]

Well if a gm crahes the server you know what to do with him

[VladimirMangos]

gm not have limitations for sent chat strings. this expected way work.