CVE-2019-25104 (published 2023-02-20T18:15Z)

A vulnerability has been found in rtcwcoop 1.0.2 and classified as problematic. Affected by this vulnerability is the function AICast_ScriptLoad of the file code/game/ai_cast_script.c of the component Team Command Handler. The manipulation leads to denial of service. The identifier of the patch is f2cd18bc2e1cbca8c4b78bee9c392272bd5f42ac. It is recommended to apply a patch to fix this issue. The identifier VDB-221485 was assigned to this vulnerability.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-404
cwe_name: Improper Resource Shutdown or Release
description: The product does not release or incorrectly releases a resource before it is made available for re-use.
extended_description: When a resource is created or allocated, the developer is responsible for properly releasing the resource as well as accounting for all potential paths of expiration or invalidation, such as a set period of time or revocation.
         

Fix information:
repo_url: https://github.com/rtcwcoop/rtcwcoop
commit_details: repo_url: https://github.com/rtcwcoop/rtcwcoop
author: Duk0
author_date: 2019-05-27 17:59:38+02:00
msg: fixed exploit where server crash by spamming team command

********************
ERROR: G_Alloc: failed on allocation of 27248 bytes
********************
----- Server Shutdown (Server crashed: G_Alloc: failed on allocation of 27248 bytes) -----

replaced G_Alloc -> trap_Alloc

anyway POOLSIZE for G_Alloc will fill up quickly just changing team in game menu
repository: repo_url: https://github.com/rtcwcoop/rtcwcoop
repo_name: rtcwcoop/rtcwcoop
description: A Return to Castle Wolfenstein modification which enables cooperative gameplay, based on iortcw
repo_language: C
owner: rtcwcoop
file_changes: filename: ai_cast_script.c
change_type: ModificationType.MODIFY
diff: @@ -391,7 +391,7 @@ void AICast_ScriptLoad( void ) {
 		return;
 	}
 
-	level.scriptAI = G_Alloc( len );
+	level.scriptAI = trap_Alloc( len );
 	trap_FS_Read( level.scriptAI, len, f );
 
 	trap_FS_FCloseFile( f );
@@ -518,7 +518,7 @@ void AICast_ScriptParse( cast_state_t *cs ) {
 			}
 
 			if ( strlen( params ) ) { // copy the params into the event
-				curEvent->params = G_Alloc( strlen( params ) + 1 );
+				curEvent->params = trap_Alloc( strlen( params ) + 1 );
 				Q_strncpyz( curEvent->params, params, strlen( params ) + 1 );
 			}
 
@@ -591,7 +591,7 @@ void AICast_ScriptParse( cast_state_t *cs ) {
 				}
 
 				if ( strlen( params ) ) { // copy the params into the event
-					curEvent->stack.items[curEvent->stack.numItems].params = G_Alloc( strlen( params ) + 1 );
+					curEvent->stack.items[curEvent->stack.numItems].params = trap_Alloc( strlen( params ) + 1 );
 					Q_strncpyz( curEvent->stack.items[curEvent->stack.numItems].params, params, strlen( params ) + 1 );
 				}
 
@@ -623,7 +623,7 @@ void AICast_ScriptParse( cast_state_t *cs ) {
 
 	// alloc and copy the events into the cast_state_t for this cast
 	if ( numEventItems > 0 ) {
-		cs->castScriptEvents = G_Alloc( sizeof( cast_script_event_t ) * numEventItems );
+		cs->castScriptEvents = trap_Alloc( sizeof( cast_script_event_t ) * numEventItems );
 		memcpy( cs->castScriptEvents, cast_temp_events, sizeof( cast_script_event_t ) * numEventItems );
 		cs->numCastScriptEvents = numEventItems;
 

programming_language: C