From 05eb8307b85de85970b3db47b5c68599bcc00e9a Mon Sep 17 00:00:00 2001 From: Stingor Date: Tue, 4 Aug 2026 08:36:22 +0200 Subject: [PATCH 1/2] Changed *mes script command declarations (#10076) Changed mes/logmes/debugmes/errormes declaration to allow numeric arguments Fixes #10042 --- src/map/script.cpp | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/src/map/script.cpp b/src/map/script.cpp index 3ba32613130..c05f24b04af 100644 --- a/src/map/script.cpp +++ b/src/map/script.cpp @@ -27927,7 +27927,7 @@ BUILDIN_FUNC(preg_match) { /// for an explanation on args, see add_buildin_func struct script_function buildin_func[] = { // NPC interaction - BUILDIN_DEF(mes,"s*"), + BUILDIN_DEF(mes,"v*"), BUILDIN_DEF(next,""), BUILDIN_DEF(clear,""), BUILDIN_DEF(close,""), @@ -28121,8 +28121,8 @@ struct script_function buildin_func[] = { BUILDIN_DEF(sc_end_class,"??"), BUILDIN_DEF(getstatus, "i??"), BUILDIN_DEF(getscrate,"ii?"), - BUILDIN_DEF(debugmes,"s"), - BUILDIN_DEF(errormes,"s"), + BUILDIN_DEF(debugmes,"v"), + BUILDIN_DEF(errormes,"v"), BUILDIN_DEF2(catchpet,"pet","??"), BUILDIN_DEF2(birthpet,"bpet",""), BUILDIN_DEF(catchpet,"??"), @@ -28230,7 +28230,7 @@ struct script_function buildin_func[] = { BUILDIN_DEF(checkoption2,"i?"), BUILDIN_DEF(guildgetexp,"i"), BUILDIN_DEF(guildchangegm,"is"), - BUILDIN_DEF(logmes,"s"), //this command actls as MES but rints info into LOG file either SQL/TXT [Lupus] + BUILDIN_DEF(logmes,"v"), //this command actls as MES but rints info into LOG file either SQL/TXT [Lupus] BUILDIN_DEF(summon,"si??"), // summons a slave monster [Celest] BUILDIN_DEF(isnight,""), // check whether it is night time [Celest] BUILDIN_DEF(isday,""), // check whether it is day time [Celest] From 721f6efbd3b813af642f9871c659695637e2db5c Mon Sep 17 00:00:00 2001 From: 5nYqnHvk <91069829+5nYqnHvk@users.noreply.github.com> Date: Tue, 4 Aug 2026 16:09:16 +0700 Subject: [PATCH 2/2] Fix Rodex mail length checks (#10027) Reject mail-send packets whose title or body lengths exceed the packet payload before copying client-controlled content. --- src/map/clif.cpp | 24 +++++++++++++++--------- 1 file changed, 15 insertions(+), 9 deletions(-) diff --git a/src/map/clif.cpp b/src/map/clif.cpp index 9067c7653c6..83060544d69 100644 --- a/src/map/clif.cpp +++ b/src/map/clif.cpp @@ -16831,8 +16831,13 @@ void clif_parse_Mail_send(int32 fd, map_session_data *sd){ mail_send(sd, RFIFOCP(fd,info->pos[1]), RFIFOCP(fd,info->pos[2]), RFIFOCP(fd,info->pos[4]), RFIFOB(fd,info->pos[3])); #else uint16 length = RFIFOW(fd, 2); +#if PACKETVER <= 20160330 + constexpr uint16 headerLength = 64; +#else + constexpr uint16 headerLength = 68; +#endif - if( length < 0x3e ){ + if( length < headerLength ){ ShowWarning("Too short...\n"); clif_Mail_send(sd, WRITE_MAIL_FAILED); return; @@ -16858,20 +16863,21 @@ void clif_parse_Mail_send(int32 fd, map_session_data *sd){ uint64 zeny = RFIFOQ(fd, 52); uint16 titleLength = RFIFOW(fd, 60); uint16 textLength = RFIFOW(fd, 62); + + if( titleLength > length - headerLength || textLength > length - headerLength - titleLength ){ + ShowWarning("Invalid Rodex mail content length from account %d.\n", sd->status.account_id); + clif_Mail_send(sd, WRITE_MAIL_FAILED); + return; + } + uint16 realTitleLength = min(titleLength, MAIL_TITLE_LENGTH); uint16 realTextLength = min(textLength, MAIL_BODY_LENGTH); char title[MAIL_TITLE_LENGTH]; char text[MAIL_BODY_LENGTH]; -#if PACKETVER <= 20160330 - safestrncpy(title, RFIFOCP(fd, 64), realTitleLength); - safestrncpy(text, RFIFOCP(fd, 64 + titleLength), realTextLength); -#else - // 64 = .L - safestrncpy(title, RFIFOCP(fd, 68), realTitleLength); - safestrncpy(text, RFIFOCP(fd, 68 + titleLength), realTextLength); -#endif + safestrncpy(title, RFIFOCP(fd, headerLength), realTitleLength); + safestrncpy(text, RFIFOCP(fd, headerLength + titleLength), realTextLength); if( zeny > 0 ){ if( mail_setitem(sd,0,(uint32)zeny) != MAIL_ATTACH_SUCCESS ){