[not confirmed][Zero] User causable crash

[namreeb]

I have a crash (and the fix) for mangos zero, which can be caused by any player connected to the world. I would prefer to first share my results privately with the developer(s) of mangos zero.

Please send me a private message on this forum to reach me.

Thank you

[lillecarl]

Just post the patch here, why would you want to keep stuff private?

[namreeb]

Because from the patch a malicious user would know how to crash any unpatched mangos zero server. I wanted to give anyone curious in the patch a chance to fix their server first. However, I have only gotten one reply so far so I suppose I've done my duty and will post it publicly soon enough.

[lillecarl]

So basicly just add a check if the map value is more then 1000 ir smth then set it to 0?

[namreeb]

Something equally simple, yes. It has been given to a mod on this forum.

[lillecarl]

How come you do not share this with everyone? That is just silly! As much code as the mangos team have shared open source with you, you should not keep your code closed source!

[Schmoozerd]

In general you don't need to be aware of bad intented users.

Players are usually not lurking around on mangos forums for exploits.

I assume there are other places for hackz and cheats and bad stuff, where they might be lurking around, but most likely not here.

[lillecarl]

Posting fixes should not be hidden, but maby the "how to exploit" should not be hidden

[Senpuria]

The fix has been given to myself to stop malicious users from figuring out how to crash mangos servers (quite abit different from using a speed hack).

I've been told that this is the same case for mangos master and one too, I'll be passing the code on to the developers so they can implement the change in master then begin to backport it to zero and one.

[namreeb]

How come you do not share this with everyone? That is just silly! As much code as the mangos team have shared open source with you, you should not keep your code closed source!

It is a common practice among open source projects to share an exploit with the developers first. The fix will of course become public, but not before the mangos team gets a chance to fix the issue. I'm sorry you don't seem to understand.

[lillecarl]

You said you already had the code fix? Then you only have to submit the patch on the forum. That is how i have seen the mangos workflow work ever since. You do not have to share the actual exploit to the public, but the fix would be helpful. Anyways this discussion is over it will only lead into flaming.

[namreeb]

You're missing the point. The fix itself would reveal the exploit to anyone with half a brain. Yes, I am done as well.