Paper/Spigot-Server-Patches/0467-Validate-PickItem-Packet-and-kick-for-invalid.patch
Daniel Ennis c97ce029e9
1.16.2 Release (#4123)
PaperMC believes that 1.16.2 is now ready for general release as we fixed the main issue plagueing the 1.16.x release, the MapLike data conversion issues.

Until now, it was not safe for a server to convert a world to 1.16.2 without data conversion issues around villages and potentially other things. If you did, those MapLike errors meant something went wrong.

This is now resolved.

Big thanks to all those that helped, notably @BillyGalbreath and @Proximyst who did large parts of the update process with me.

Please as always, backup your worlds and test before updating to 1.16.2!

If you update to 1.16.2, there is no going back to an older build than this.

---------------------------------

Co-authored-by: William Blake Galbreath <Blake.Galbreath@GMail.com>
Co-authored-by: Mariell Hoversholm <proximyst@proximyst.com>
Co-authored-by: krolik-exe <69214078+krolik-exe@users.noreply.github.com>
Co-authored-by: BillyGalbreath <BillyGalbreath@users.noreply.github.com>
Co-authored-by: stonar96 <minecraft.stonar96@gmail.com>
Co-authored-by: Shane Freeder <theboyetronic@gmail.com>
Co-authored-by: Jason <jasonpenilla2@me.com>
Co-authored-by: kashike <kashike@vq.lc>
Co-authored-by: Aurora <21148213+aurorasmiles@users.noreply.github.com>
Co-authored-by: KennyTV <kennytv@t-online.de>
Co-authored-by: commandblockguy <commandblockguy1@gmail.com>
Co-authored-by: DigitalRegent <misterwener@gmail.com>
Co-authored-by: ishland <ishlandmc@yeah.net>
2020-08-24 22:40:19 -04:00

27 lines
1.8 KiB
Diff

From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Aikar <aikar@aikar.co>
Date: Sat, 2 May 2020 03:09:46 -0400
Subject: [PATCH] Validate PickItem Packet and kick for invalid
diff --git a/src/main/java/net/minecraft/server/PlayerConnection.java b/src/main/java/net/minecraft/server/PlayerConnection.java
index 5f1e7e4bc3ae80f4ed61f2d65da1cf9935a3882a..7b079f0e594e24a7d8706c4ed5228c37c5fbe26d 100644
--- a/src/main/java/net/minecraft/server/PlayerConnection.java
+++ b/src/main/java/net/minecraft/server/PlayerConnection.java
@@ -691,7 +691,14 @@ public class PlayerConnection implements PacketListenerPlayIn {
@Override
public void a(PacketPlayInPickItem packetplayinpickitem) {
PlayerConnectionUtils.ensureMainThread(packetplayinpickitem, this, this.player.getWorldServer());
- this.player.inventory.c(packetplayinpickitem.b());
+ // Paper start - validate pick item position
+ if (!(packetplayinpickitem.b() >= 0 && packetplayinpickitem.b() < this.player.inventory.items.size())) {
+ PlayerConnection.LOGGER.warn("{} tried to set an invalid carried item", this.player.getDisplayName().getString());
+ this.disconnect("Invalid hotbar selection (Hacking?)");
+ return;
+ }
+ this.player.inventory.c(packetplayinpickitem.b()); // Paper - Diff above if changed
+ // Paper end
this.player.playerConnection.sendPacket(new PacketPlayOutSetSlot(-2, this.player.inventory.itemInHandIndex, this.player.inventory.getItem(this.player.inventory.itemInHandIndex)));
this.player.playerConnection.sendPacket(new PacketPlayOutSetSlot(-2, packetplayinpickitem.b(), this.player.inventory.getItem(packetplayinpickitem.b())));
this.player.playerConnection.sendPacket(new PacketPlayOutHeldItemSlot(this.player.inventory.itemInHandIndex));