8000 Validate uncompressed packet size by jonesdevelopment · Pull Request #1527 · PaperMC/Velocity · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

Validate uncompressed packet size #1527

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 2 commits into from
Mar 14, 2025
Merged

Validate uncompressed packet size #1527

merged 2 commits into from
Mar 14, 2025

Conversation

jonesdevelopment
Copy link
Contributor

In Minecraft, the client never sends a claimed uncompressed packet size of 0 if the actual size of the packet exceeds the compression threshold. In Velocity, there is no check to confirm that packets are the size they claim to be.

While this is not a huge vulnerability, it can be used to force Velocity to skip packets during compression, therefore potentially allowing people to send arbitrarily large packets.

For reference, this is the decompiled code of MCP for 1.19.2 and 1.21.4 (it's the same for all other version as well):
image
image

As you can see, the client uses the actual packet size to determine whether to compress the packet or not. Velocity simply relies on the claimedUncompressedSize, which can simply be set to 0 to skip the entire compression process.

Velocity/proxy/src/main/java/com/velocitypowered/proxy/protocol/netty/MinecraftCompressDecoder.java

Lines 53 to 58 in c9aa1cc

int claimedUncompressedSize = ProtocolUtils.readVarInt(in);
if (claimedUncompressedSize == 0) {
// This message is not compressed.
out.add(in.retain());
return;
}

@electronicboy electronicboy merged commit d9f1016 into PaperMC:dev/3.0.0 Mar 14, 2025
1 check passed
WiIIiam278 pushed a commit to WiIIiam278/Velocity that referenced this pull request Mar 24, 2025
@jonesdevelopment @WiIIiam278
Validate uncompressed packet size (PaperMC#1527)
7141128 
* Validate uncompressed packet size

* Fix debug using incorrect value
This was referenced Apr 18, 2025
Open
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@electronicboy electronicboy electronicboy approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@jonesdevelopment @electronicboy
0