Skip to content

server: reject invalid spectator targets safely - #1721

Open
acts-1631 wants to merge 1 commit into
redeclipse:masterfrom
acts-1631:fix-invalid-spectator-target
Open

acts-1631 wants to merge 1 commit into
redeclipse:masterfrom
acts-1631:fix-invalid-spectator-target

Conversation

@acts-1631

Copy link
Copy Markdown

A connected client can send N_SPECTATOR with a nonexistent client number. In the N_SPECTATOR handler in src/game/server.cpp, getinfo() returns NULL, but the invalid-request path still passes that pointer to colourname() and reads cp->state and cp->lastdeath. Any connected player can therefore terminate the dedicated server and disrupt the match.

Handle the invalid target before formatting state-dependent diagnostics. The handler now sends a generic error and exits before dereferencing the missing clientinfo.

@acts-1631
acts-1631 requested a review from a team as a code owner September 15, 2026 20:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant