OpenTTD

Tasklist

FS#2849 - "connect" console command does not validate company ID properly

Attached to Project: OpenTTD
Opened by Bilbo (bilbo) - Sunday, 19 April 2009, 12:21 GMT
Last edited by Remko Bijker (Rubidium) - Sunday, 19 April 2009, 22:24 GMT
Type Bug
Category Interface
Status Closed
Assigned To No-one
Operating System All
Severity Low
Priority Normal
Reported Version trunk
Due in Version Undecided
Due Date Undecided
Percent Complete 100%
Votes 0
Private No

Details

While working on one patch of my own (reconnect console command) I noticed a flaw in the "connect" console command (ConNetworkConnect in console_cmds.cpp) - well, because I found out my patch suffered from the same flaw too :)

The "connect" command allows you to specify company you want to join, however, it uses IsValidCompanyID() function to validate the ID given as parameter. But this function not only validates that the company ID lies withing reasonable bounds (0..MAX_COMPANIES-1), it also tries to validate the ID by examining current company list. This is done before connecting to server, so this uses list from whatever game that is currently loaded (which mean you can join only first company on server using that command if you do it from the intro screen for example).
This task depends upon

Closed by  Remko Bijker (Rubidium)
Sunday, 19 April 2009, 22:24 GMT
Reason for closing:  Fixed
Additional comments about closing:  In r16096

Loading...