Ensure file path is within bounds

An old upstream change

[ci skip]

Author: patrikjuvonen

Client/mods/deathmatch/logic/CPacketHandler.cpp

@@ -4999,6 +4999,8 @@ void CPacketHandler::Packet_ResourceStart(NetBitStreamInterface& bitStream)
         return;
     }
 
+    bool bFatalError = false;
+
     CResource* pResource = g_pClientGame->m_pResourceManager->Add(usResourceID, szResourceName, pResourceEntity, pResourceDynamicEntity, strMinServerReq,
                                                                   strMinClientReq, bEnableOOP);
     if (pResource)
@@ -5047,61 +5049,80 @@ void CPacketHandler::Packet_ResourceStart(NetBitStreamInterface& bitStream)
                         }
                         szChunkData[ucChunkSize] = NULL;
 
-                        bitStream.Read(ucChunkSubType);
-                        bitStream.Read(chunkChecksum.ulCRC);
-                        bitStream.Read((char*)chunkChecksum.md5.data, sizeof(chunkChecksum.md5.data));
-                        bitStream.Read(dChunkDataSize);
-
-                        uint uiDownloadSize = (uint)dChunkDataSize;
-                        uiTotalSizeProcessed += uiDownloadSize;
-                        if (uiTotalSizeProcessed / 1024 / 1024 > 50)
-                            g_pCore->UpdateDummyProgress(uiTotalSizeProcessed / 1024 / 1024, " MB");
-
-                        // Create the resource downloadable
-                        CDownloadableResource* pDownloadableResource = NULL;
-                        switch (ucChunkSubType)
+                        std::string strChunkData = szChunkData;
+                        // make the full file path (c:/path/to/mods/deathmatch/resources/resource/)
+                        std::string           strMetaPathTemp;
+                        std::string           strResPathTemp = pResource->GetResourceDirectoryPath(ACCESS_PUBLIC, strMetaPathTemp);
+                        std::filesystem::path fsResPath = std::filesystem::path(strResPathTemp).lexically_normal();
+                        std::string           strResPath = fsResPath.string();
+                        // make the full file path (c:/path/to/mods/deathmatch/resources/resource/file.lua)
+                        std::string           strResFilePathTemp = strResPath + static_cast<char>(std::filesystem::path::preferred_separator) + strChunkData;
+                        std::filesystem::path fsResFilePath = std::filesystem::path(strResFilePathTemp).lexically_normal();
+                        std::string           strResFilePath = fsResFilePath.string();
+                        // check that full file path contains full resource path
+                        if (strResFilePath.rfind(strResPath.c_str(), 0) != 0)
+                        {
+                            bFatalError = true;
+                            AddReportLog(2081, SString("Path %s (expected %s)", strResFilePath.c_str(), strResPath.c_str()));
+                        }
+                        else
                         {
-                            case CDownloadableResource::RESOURCE_FILE_TYPE_CLIENT_FILE:
+                            bitStream.Read(ucChunkSubType);
+                            bitStream.Read(chunkChecksum.ulCRC);
+                            bitStream.Read((char*)chunkChecksum.md5.data, sizeof(chunkChecksum.md5.data));
+                            bitStream.Read(dChunkDataSize);
+
+                            uint uiDownloadSize = (uint)dChunkDataSize;
+                            uiTotalSizeProcessed += uiDownloadSize;
+                            if (uiTotalSizeProcessed / 1024 / 1024 > 50)
+                                g_pCore->UpdateDummyProgress(uiTotalSizeProcessed / 1024 / 1024, " MB");
+
+                            // Create the resource downloadable
+                            CDownloadableResource* pDownloadableResource = NULL;
+                            switch (ucChunkSubType)
                             {
-                                bool bDownload = bitStream.ReadBit();
-                                pDownloadableResource = pResource->AddResourceFile(CDownloadableResource::RESOURCE_FILE_TYPE_CLIENT_FILE, szChunkData,
-                                                                                   uiDownloadSize, chunkChecksum, bDownload);
-
-                                break;
-                            }
-                            case CDownloadableResource::RESOURCE_FILE_TYPE_CLIENT_SCRIPT:
-                                pDownloadableResource = pResource->AddResourceFile(CDownloadableResource::RESOURCE_FILE_TYPE_CLIENT_SCRIPT, szChunkData,
-                                                                                   uiDownloadSize, chunkChecksum, true);
+                                case CDownloadableResource::RESOURCE_FILE_TYPE_CLIENT_FILE:
+                                {
+                                    bool bDownload = bitStream.ReadBit();
+                                    pDownloadableResource = pResource->AddResourceFile(CDownloadableResource::RESOURCE_FILE_TYPE_CLIENT_FILE, szChunkData,
+                                                                                       uiDownloadSize, chunkChecksum, bDownload);
 
-                                break;
-                            case CDownloadableResource::RESOURCE_FILE_TYPE_CLIENT_CONFIG:
-                                pDownloadableResource = pResource->AddConfigFile(szChunkData, uiDownloadSize, chunkChecksum);
+                                    break;
+                                }
+                                case CDownloadableResource::RESOURCE_FILE_TYPE_CLIENT_SCRIPT:
+                                    pDownloadableResource = pResource->AddResourceFile(CDownloadableResource::RESOURCE_FILE_TYPE_CLIENT_SCRIPT, szChunkData,
+                                                                                       uiDownloadSize, chunkChecksum, true);
 
-                                break;
-                            default:
+                                    break;
+                                case CDownloadableResource::RESOURCE_FILE_TYPE_CLIENT_CONFIG:
+                                    pDownloadableResource = pResource->AddConfigFile(szChunkData, uiDownloadSize, chunkChecksum);
 
-                                break;
-                        }
+                                    break;
+                                default:
 
-                        // Does the Client and Server checksum differ?
-                        if (pDownloadableResource && !pDownloadableResource->DoesClientAndServerChecksumMatch())
-                        {
-                            // Delete the file that already exists
-                            FileDelete(pDownloadableResource->GetName());
-                            if (FileExists(pDownloadableResource->GetName()))
-                            {
-                                SString strMessage("Unable to delete old file %s", *ConformResourcePath(pDownloadableResource->GetName()));
-                                g_pClientGame->TellServerSomethingImportant(1009, strMessage);
+                                    break;
                             }
 
-                            // Is it downloadable now?
-                            if (pDownloadableResource->IsAutoDownload())
+                            // Does the Client and Server checksum differ?
+                            if (pDownloadableResource && !pDownloadableResource->DoesClientAndServerChecksumMatch())
                             {
-                                // Make sure the directory exists
-                                MakeSureDirExists(pDownloadableResource->GetName());
+                                // Delete the file that already exists
+                                FileDelete(pDownloadableResource->GetName());
+                                if (FileExists(pDownloadableResource->GetName()))
+                                {
+                                    SString strMessage("Unable to delete old file %s", *ConformResourcePath(pDownloadableResource->GetName()));
+                                    g_pClientGame->TellServerSomethingImportant(1009, strMessage);
+                                }
 
-                                // Queue the file to be downloaded
-                                g_pClientGame->GetResourceFileDownloadManager()->AddPendingFileDownload(pDownloadableResource);
+                                // Is it downloadable now?
+                                if (pDownloadableResource->IsAutoDownload())
+                                {
+                                    // Make sure the directory exists
+                                    MakeSureDirExists(pDownloadableResource->GetName());
+
+                                    // Queue the file to be downloaded
+                                    g_pClientGame->GetResourceFileDownloadManager()->AddPendingFileDownload(pDownloadableResource);
+                                }
                             }
                         }
                     }
@@ -5116,17 +5137,25 @@ void CPacketHandler::Packet_ResourceStart(NetBitStreamInterface& bitStream)
                 delete[] szChunkData;
                 szChunkData = NULL;
             }
-        }
 
-        g_pClientGame->GetResourceFileDownloadManager()->UpdatePendingDownloads();
+            if (bFatalError)
+            {
+                break;
+            }
+        }
 
-        // Are there any resources to being downloaded?
-        if (!g_pClientGame->GetResourceFileDownloadManager()->IsTransferringInitialFiles())
+        if (!bFatalError)
         {
-            // Load the resource now
-            if (pResource->CanBeLoaded())
+            g_pClientGame->GetResourceFileDownloadManager()->UpdatePendingDownloads();
+
+            // Are there any resources to being downloaded?
+            if (!g_pClientGame->GetResourceFileDownloadManager()->IsTransferringInitialFiles())
             {
-                pResource->Load();
+                // Load the resource now
+                if (pResource->CanBeLoaded())
+                {
+                    pResource->Load();
+                }
             }
         }
     }
@@ -5136,6 +5165,11 @@ void CPacketHandler::Packet_ResourceStart(NetBitStreamInterface& bitStream)
 
     g_pCore->UpdateDummyProgress(0);
     totalSizeProcessedResetTimer.Reset();
+
+    if (bFatalError)
+    {
+        RaiseFatalError(2081);
+    }
 }
 
 void CPacketHandler::Packet_ResourceStop(NetBitStreamInterface& bitStream)

Client/mods/deathmatch/logic/CPacketHandler.h

@@ -11,6 +11,7 @@
 
 #pragma once
 
+#include <filesystem>
 #include <CClientCommon.h>
 
 class CClientEntity;