chunk.NetworkDecode and (*chunk.Chunk).SetBlock panic on certain data

[HashimTheArab]

SetBlock Panic

func (w *World) SetBlockByRuntimeID(pos cube.Pos, blockID uint32) {
	if cube.Pos(pos).OutOfBounds(cube.Range(w.Dimension().Range())) {
		return
	}

	chunkPos := protocol.ChunkPos{int32(pos[0]) >> 4, int32(pos[2]) >> 4}
	c := w.Chunk(chunkPos) // This returns a dragonfly *chunk.Chunk
	if c == nil {
		return
	}

	c.SetBlock(uint8(pos[0]), int16(pos[1]), uint8(pos[2]), 0, blockID) // This line panics
}

case *packet.UpdateBlock:
	rid := pk.NewBlockRuntimeID
	_, ok := world.BlockByRuntimeID(rid)
	if !ok {
		rid = airRuntimeID
	}

	pos := cube.Pos{int(pk.Position.X()), int(pk.Position.Y()), int(pk.Position.Z())}
	p.player.World().SetBlockByRuntimeID(pos, rid)

github.com/df-mc/dragonfly/server/world/chunk in (*Chunk).SetBlock at line 88
runtime error: index out of range [-1]

dragonfly/server/world/chunk/chunk.go

Line 88 in 1171b7e

sub := chunk.sub[chunk.SubIndex(y)]

chunk.NetworkDecode panic

chunk.NetworkDecode panic: runtime error: index out of range [109] with length 24

case *packet.LevelChunk:
	dim := dimensionFromNetworkID(pk.Dimension)

	c, err := chunk.NetworkDecode(airRuntimeID, pk.RawPayload, int(pk.SubChunkCount), dim.Range())
	if err != nil {
	 	c = chunk.New(airRuntimeID, dim.Range())
	}

github.com/df-mc/dragonfly/server/world/chunk in NetworkDecode at line 24

dragonfly/server/world/chunk/decode.go

Line 24 in 1171b7e

c.sub[index], err = decodeSubChunk(buf, c, &index, NetworkEncoding)

I have many logs of chunk data from these crashes, here's a log of *packet.LevelChunk
https://gist.github.com/HashimTheArab/1ebab2a39a22d8af009987d96b598a24

[ethaniccc]

bump

[Flonja]

I can't really help with the first issue, since there isn't enough information (missing a buffer & chunk dump)
For the second issue, it seems like this is to combat proxies by sending a subchunk version 9 with an index out of range... this should handle this error:

	var (
		c   = New(air, r)
		buf = bytes.NewBuffer(data)
-		err error
+		n   = uint8((r.Height() >> 4) + 1)
	)
	for i := 0; i < count; i++ {
		index := uint8(i)
-		c.sub[index], err = decodeSubChunk(buf, c, &index, NetworkEncoding)
+		sub, err := decodeSubChunk(buf, c, &index, NetworkEncoding)
		if err != nil {
			return nil, err
		}
+		if index > n {
+			return nil, fmt.Errorf("index out of range")
+		}
+		c.sub[index] = sub
	}

Code used: (with dump: https://gist.github.com/HashimTheArab/1ebab2a39a22d8af009987d96b598a24)

import (
	"encoding/base64"
	"encoding/json"
	"github.com/df-mc/dragonfly/server/block"
	"github.com/df-mc/dragonfly/server/world"
	"github.com/df-mc/dragonfly/server/world/chunk"
	"os"
	_ "unsafe"
)

type LevelChunkDump struct {
	Position        []int  `json:"position"`
	Dimension       int    `json:"dimension"`
	BlobHashes      string `json:"blob_hashes"`
	CacheEnabled    bool   `json:"cache_enabled"`
	SubChunkCount   int    `json:"subchunk_count"`
	RawPayloadB64   string `json:"raw_payload_b64"`
	HighestSubchunk int    `json:"highest_subchunk"`
}

func main() {
	world_finaliseBlockRegistry()

	file, err := os.ReadFile("level_chunk_dump.json")
	if err != nil {
		panic(err)
	}
	var pk LevelChunkDump

	if err := json.Unmarshal(file, &pk); err != nil {
		panic(err)
	}
	rawPayload, err := base64.StdEncoding.DecodeString(pk.RawPayloadB64)
	if err != nil {
		panic(err)
	}

	dim, _ := world.DimensionByID(pk.Dimension)

	airRuntimeID := world.BlockRuntimeID(block.Air{})
	c, err := chunk.NetworkDecode(airRuntimeID, rawPayload, pk.SubChunkCount, dim.Range())
	if err != nil {
		c = chunk.New(airRuntimeID, dim.Range())
	}
	_ = c
}

// noinspection ALL
//
//go:linkname world_finaliseBlockRegistry github.com/df-mc/dragonfly/server/world.finaliseBlockRegistry
func world_finaliseBlockRegistry()

[ismaileke]

I THOUGHT THE PROBLEM WAS MINE. YEYYYYYYY

[ismaileke]

I can't really help with the first issue, since there isn't enough information (missing a buffer & chunk dump) For the second issue, it seems like this is to combat proxies by sending a subchunk version 9 with an index out of range... this should handle this error:

var (
c = New(air, r)
buf = bytes.NewBuffer(data)

• err error
  

• n   = uint8((r.Height() >> 4) + 1)
  

  )
  for i := 0; i < count; i++ {
  index := uint8(i)

• c.sub[index], err = decodeSubChunk(buf, c, &index, NetworkEncoding)
  

• sub, err := decodeSubChunk(buf, c, &index, NetworkEncoding)
  if err != nil {
  	return nil, err
  }
  

• if index < 0 || index > n {
  

• 	return nil, fmt.Errorf("index out of range")
  

• }
  

• c.sub[index] = sub
  

  }
  Code used: (with dump: https://gist.github.com/HashimTheArab/1ebab2a39a22d8af009987d96b598a24)

import (
"encoding/base64"
"encoding/json"
"github.com/df-mc/dragonfly/server/block"
"github.com/df-mc/dragonfly/server/world"
"github.com/df-mc/dragonfly/server/world/chunk"
"os"
_ "unsafe"
)

type LevelChunkDump struct {
Position []int json:"position"
Dimension int json:"dimension"
BlobHashes string json:"blob_hashes"
CacheEnabled bool json:"cache_enabled"
SubChunkCount int json:"subchunk_count"
RawPayloadB64 string json:"raw_payload_b64"
HighestSubchunk int json:"highest_subchunk"
}

func main() {
world_finaliseBlockRegistry()

file, err := os.ReadFile("level_chunk_dump.json")
if err != nil {
panic(err)
}
var pk LevelChunkDump

if err := json.Unmarshal(file, &pk); err != nil {
panic(err)
}
rawPayload, err := base64.StdEncoding.DecodeString(pk.RawPayloadB64)
if err != nil {
panic(err)
}

dim, _ := world.DimensionByID(pk.Dimension)

airRuntimeID := world.BlockRuntimeID(block.Air{})
c, err := chunk.NetworkDecode(airRuntimeID, rawPayload, pk.SubChunkCount, dim.Range())
if err != nil {
c = chunk.New(airRuntimeID, dim.Range())
}
_ = c
}

// noinspection ALL
//
//go:linkname world_finaliseBlockRegistry github.com/df-mc/dragonfly/server/world.finaliseBlockRegistry
func world_finaliseBlockRegistry()

im not sure if this works but index < 0 can't happen anyway because it's unsigned 8

[Flonja]

Good catch, just edited my patch