TrinityCore/TrinityCore — pull request #4646 by elecyb (2012-01-05 22:30:37+00:00)
Title: Core/PacketIO: Fix crash and exploit caused when client sends tampered m...

...over guids

How the crash is caused:
The attacker needs 2 chars and a packet editor with some logic (can't use WPE). Player A knows the guid of Player B

1) Player B login
2) Player A login sending CMSG_SET_ACTIVE_MOVER with the guid of Player B, then Player A have as mover the Player B
3) Player B logout. Now Player A have as mover invalid pointer to non-existant Player B
4) Player A sends MSG_MOVE_XXX packet
5) Result: 100% server crash

If also Player A manipulates the guid of MSG_MOVE he can gain control over other's player movements.

The fix:

It's insecure and unnecesary to set the mover based on the guid recived from client, instead of that, it can be set in the functions that require set new player mover, eg: when player login and when spells with Possess aura effect are casted.
This implementation is based on the current Mangos code, so thanks to them.

PS: I changed code in low level functions so please test this and report unexpected behavior like being unable to move.