[ioquake3] 130/136: Only allow connectionless print/echo from server/rcon address

[Simon McVittie]

This is an automated email from the git hooks/post-receive script.

smcv pushed a commit to branch debian/master
in repository ioquake3.

commit e9436abff0feed3e316c95ed706779f4bdfdf1c9
Author: Zack Middleton <zack at cloemail.com>
Date:   Sat Jun 10 19:06:04 2017 -0500

    Only allow connectionless print/echo from server/rcon address
    
    Reported by Ensiform.
---
 code/client/cl_main.c | 18 ++++++++++++------
 code/client/client.h  |  2 ++
 2 files changed, 14 insertions(+), 6 deletions(-)

diff --git a/code/client/cl_main.c b/code/client/cl_main.c
index e9a406e..b0712a3 100644
--- a/code/client/cl_main.c
+++ b/code/client/cl_main.c
@@ -1891,6 +1891,7 @@ void CL_Rcon_f( void ) {
 	}
 	
 	NET_SendPacket (NS_CLIENT, strlen(message)+1, message, to);
+	cls.rconAddress = to;
 }
 
 /*
@@ -2749,7 +2750,10 @@ void CL_ConnectionlessPacket( netadr_t from, msg_t *msg ) {
 
 	// echo request from server
 	if ( !Q_stricmp(c, "echo") ) {
-		NET_OutOfBandPrint( NS_CLIENT, from, "%s", Cmd_Argv(1) );
+		// NOTE: we may have to add exceptions for auth and update servers
+		if ( NET_CompareAdr( from, clc.serverAddress ) || NET_CompareAdr( from, cls.rconAddress ) ) {
+			NET_OutOfBandPrint( NS_CLIENT, from, "%s", Cmd_Argv(1) );
+		}
 		return;
 	}
 
@@ -2766,12 +2770,14 @@ void CL_ConnectionlessPacket( netadr_t from, msg_t *msg ) {
 	}
 
 	// echo request from server
-	if(!Q_stricmp(c, "print")){
-		s = MSG_ReadString( msg );
-		
-		Q_strncpyz( clc.serverMessage, s, sizeof( clc.serverMessage ) );
-		Com_Printf( "%s", s );
+	if ( !Q_stricmp(c, "print") ) {
+		// NOTE: we may have to add exceptions for auth and update servers
+		if ( NET_CompareAdr( from, clc.serverAddress ) || NET_CompareAdr( from, cls.rconAddress ) ) {
+			s = MSG_ReadString( msg );
 
+			Q_strncpyz( clc.serverMessage, s, sizeof( clc.serverMessage ) );
+			Com_Printf( "%s", s );
+		}
 		return;
 	}
 
diff --git a/code/client/client.h b/code/client/client.h
index 0fe3889..0d3e1c3 100644
--- a/code/client/client.h
+++ b/code/client/client.h
@@ -344,6 +344,8 @@ typedef struct {
 
 	netadr_t	authorizeServer;
 
+	netadr_t	rconAddress;
+
 	// rendering info
 	glconfig_t	glconfig;
 	qhandle_t	charSetShader;

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/pkg-games/ioquake3.git