commit f1a8d991aa8a14afcb605cf2f65cd15fda204c56
Author:     Fabian Greffrath <fabian@greffrath.com>
AuthorDate: Wed Jun 24 12:45:03 2020 +0200
Commit:     Fabian Greffrath <fabian@greffrath.com>
CommitDate: Wed Jun 24 12:45:03 2020 +0200

    net: fix missing server-side num_players validation (CVE-2020-14983)

    The server in Chocolate Doom 3.0.0 and Crispy Doom 5.8.0 doesn't
    validate the user-controlled num_players value, leading to a buffer
    overflow. A malicious user can overwrite the server's stack.

    Fixes CVE-2020-14983, found by Michał Dardas from LogicalTrust.

    Fixes: #1293.
---
 src/net_structrw.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/net_structrw.c b/src/net_structrw.c
index 437bc71a..2dbd2740 100644
--- a/src/net_structrw.c
+++ b/src/net_structrw.c
@@ -116,7 +116,7 @@ boolean NET_ReadSettings(net_packet_t *packet, net_gamesettings_t *settings)
         return false;
     }

-    for (i = 0; i < settings->num_players; ++i)
+    for (i = 0; i < settings->num_players && i < NET_MAXPLAYERS; ++i)
     {
         if (!NET_ReadInt8(packet,
                           (unsigned int *) &settings->player_classes[i]))