CVE-2019-25104: Improper Resource Shutdown or Release (CWE-404)
value: A vulnerability has been found in rtcwcoop 1.0.2 and classified as problematic. Affected by this vulnerability is the function AICast_ScriptLoad of the file code/game/ai_cast_script.c of the component Team Command Handler. The manipulation leads to denial of service. The identifier of the patch is f2cd18bc2e1cbca8c4b78bee9c392272bd5f42ac. It is recommended to apply a patch to fix this issue. The identifier VDB-221485 was assigned to this vulnerability.
CWE description: The product does not release or incorrectly releases a resource before it is made available for re-use.
CVSS v3 base score: 7.5
Published: 2023-02-20T18:15Z
Repository: https://github.com/rtcwcoop/rtcwcoop
Language: C
Files changed: code/game/ai_cast_script.c
Commit date: 2019-05-27 17:59:38 +0200
Commit message: fixed exploit where server crash by spamming team command

********************
ERROR: G_Alloc: failed on allocation of 27248 bytes
********************
----- Server Shutdown (Server crashed: G_Alloc: failed on allocation of 27248 bytes) -----

replaced G_Alloc -> trap_Alloc

anyway POOLSIZE for G_Alloc will fill up quickly just changing team in game menu

Diff: diff --git a/code/game/ai_cast_script.c b/code/game/ai_cast_script.c
index bbde710..c6c9f2b 100644
--- a/code/game/ai_cast_script.c
+++ b/code/game/ai_cast_script.c
@@ -389,11 +389,11 @@ void AICast_ScriptLoad( void ) {
 
 	if ( len < 0 ) {
 		return;
 	}
 
-	level.scriptAI = G_Alloc( len );
+	level.scriptAI = trap_Alloc( len );
 	trap_FS_Read( level.scriptAI, len, f );
 
 	trap_FS_FCloseFile( f );
 
 	return;
@@ -516,11 +516,11 @@ void AICast_ScriptParse( cast_state_t *cs ) {
 				}
 				Q_strcat( params, sizeof( params ), token );
 			}
 
 			if ( strlen( params ) ) { // copy the params into the event
-				curEvent->params = G_Alloc( strlen( params ) + 1 );
+				curEvent->params = trap_Alloc( strlen( params ) + 1 );
 				Q_strncpyz( curEvent->params, params, strlen( params ) + 1 );
 			}
 
 			// parse the actions for this event
 			while ( ( token = COM_Parse( &pScript ) ) && ( token[0] != '}' ) )
@@ -589,11 +589,11 @@ void AICast_ScriptParse( cast_state_t *cs ) {
 
 					token = COM_ParseExt( &pScript, qfalse );
 				}
 
 				if ( strlen( params ) ) { // copy the params into the event
-					curEvent->stack.items[curEvent->stack.numItems].params = G_Alloc( strlen( params ) + 1 );
+					curEvent->stack.items[curEvent->stack.numItems].params = trap_Alloc( strlen( params ) + 1 );
 					Q_strncpyz( curEvent->stack.items[curEvent->stack.numItems].params, params, strlen( params ) + 1 );
 				}
 
 				curEvent->stack.numItems++;
 
@@ -621,11 +621,11 @@ void AICast_ScriptParse( cast_state_t *cs ) {
 		}
 	}
 
 	// alloc and copy the events into the cast_state_t for this cast
 	if ( numEventItems > 0 ) {
-		cs->castScriptEvents = G_Alloc( sizeof( cast_script_event_t ) * numEventItems );
+		cs->castScriptEvents = trap_Alloc( sizeof( cast_script_event_t ) * numEventItems );
 		memcpy( cs->castScriptEvents, cast_temp_events, sizeof( cast_script_event_t ) * numEventItems );
 		cs->numCastScriptEvents = numEventItems;
 
 		cs->castScriptStatus.castScriptEventIndex = -1;
 	}

Vulnerable code: 	level.scriptAI = G_Alloc( len );
				curEvent->params = G_Alloc( strlen( params ) + 1 );
					curEvent->stack.items[curEvent->stack.numItems].params = G_Alloc( strlen( params ) + 1 );
		cs->castScriptEvents = G_Alloc( sizeof( cast_script_event_t ) * numEventItems );
Fixed code: 	level.scriptAI = trap_Alloc( len );
				curEvent->params = trap_Alloc( strlen( params ) + 1 );
					curEvent->stack.items[curEvent->stack.numItems].params = trap_Alloc( strlen( params ) + 1 );
		cs->castScriptEvents = trap_Alloc( sizeof( cast_script_event_t ) * numEventItems );