[Owyn]

beware of dis mightly error ! :>

[Pr4yer]

+1

L 02/26/2010 - 03:02:53: "RBW<-1><><CT>" disconnected
Dropped RBW from server
Reason:  Server shutting down
L 02/26/2010 - 03:02:53: "Indica<-1><><CT>" disconnected
Dropped Indica from server
Reason:  Server shutting down
L 02/26/2010 - 03:02:53: "unnamed<-1><><CT>" disconnected
Dropped unnamed from server
Reason:  Server shutting down
L 02/26/2010 - 03:02:53: "[merkon] || KGD<-1><><CT>" disconnected
L 02/26/2010 - 03:02:53: World triggered "Round_Draw" (CT "1") (T "0")
L 02/26/2010 - 03:02:53: World triggered "Round_End"
Dropped [merkon] || KGD from server
Reason:  Server shutting down
L 02/26/2010 - 03:02:53: Server shutdown
L 02/26/2010 - 03:02:53: Log file closed
L 02/26/2010 - 03:02:53: FATAL ERROR (shutting down): Host_Error: SV_ParseVoiceData: invalid incoming packet.


FATAL ERROR (shutting down): Host_Error: SV_ParseVoiceData: invalid incoming packet.


email debug.log to [email protected]
Птн Фев 26 03:02:53 MSK 2010: Server restart in 10 seconds

Console initialized.
scandir failed:/srv/cs/./platform/SAVE
Protocol version 48
Exe version 1.1.2.6/Stdio (cstrike)
Exe build: 15:58:06 Jun 15 2009 (4617)
STEAM Auth Server

[Pr4yer]

I found a piece of source as...

checking for a variable (sv_voiceenable) should be first, only then check here is "if (nDataLength > sizeof (chReceived))"...

00035 ConVar sv_voiceenable( "sv_voiceenable", "1", FCVAR_ARCHIVE|FCVAR_SERVER ); // set to 0 to disable all voice forwarding.
00036 extern ConVar   sv_cheats;
00037 
00038 // Gets voice data from a client and forwards it to anyone who can hear this client.
00039 void SV_ParseVoiceData(client_t *cl)
00040 {
00041         int i, iClient;
00042         int     nDataLength;
00043         char chReceived[4096];
00044         client_t *pDestClient;
00045         
00046         iClient = cl - svs.clients;
00047 
00048         // Read in the data.    
00049         nDataLength = MSG_ReadShort();
00050         if( nDataLength > sizeof(chReceived) )
00051         {
00052                 Host_Error("SV_ParseVoiceData: invalid incoming packet.\n");
00053                 return;
00054         }
00055 
00056         MSG_ReadBuf( nDataLength, chReceived );
00057 
00058 
00059         // Disable voice?
00060         if( !sv_voiceenable.GetInt() )
00061                 return;
00062 
00063         for(i=0; i < MAX_CLIENTS; i++)
00064         {
00065                 qboolean bLocal;
00066                 int nSendLength;
00067 
00068                 pDestClient = &svs.clients[i];
00069                 bLocal = (pDestClient == cl);
00070 
00071                 // Does the game code want cl sending to this client?
00072                 if(!(cl->m_VoiceStreams[i>>5] & (1 << (i & 31))) && !bLocal)
00073                         continue;
00074                 
00075                 // Is this client even on the server?
00076                 if(!pDestClient->active && !pDestClient->connected && !bLocal)
00077                         continue;
00078 
00079                 // Is loopback enabled?
00080                 nSendLength = nDataLength;
00081                 if(bLocal && !pDestClient->m_bLoopback)
00082                 {
00083                         nSendLength = 0;        // Still send something, just zero length (this is so the client 
00084                                                                 // can display something that shows knows the server knows it's talking).
00085                 }
00086 
00087                 // Is there room to write this data in?
00088                 if( pDestClient->datagram.GetNumBytesLeft() >= (6 + nDataLength) )
00089                 {
00090                         pDestClient->datagram.WriteByte( svc_voicedata );
00091                         pDestClient->datagram.WriteByte( (byte)iClient );
00092                         pDestClient->datagram.WriteShort( nSendLength );
00093                         pDestClient->datagram.WriteBytes( chReceived, nSendLength );
00094                 }
00095         }
00096 }

might be better to block the sound of sending commands to the client type client_cmd(id, " alias +voicerecord ") or through fakemeta:

register_forward(FM_Voice_SetClientListening, "fwdSetVoice", 0)

public fwdSetVoice(receiver, sender)//, bool:bListen)
{
	if(!is_user_connected(receiver) || !is_user_connected(sender))
            return FMRES_SUPERCEDE // return FMRES_IGNORED

	engfunc(EngFunc_SetClientListening, receiver, sender, 0)
	
	return FMRES_SUPERCEDE
}

???

[Owyn]

with latest steam update you can't alias existing commands\cvars.

you'r going to disable all voice at all, aren't you?

tell valve about this and wait for fix

ps - show your amxx list and meta list maybe you have plugins which cause this error

[Pr4yer]

on my server is sv_voiceenable "0", and this error is in the void SV_ParseVoiceData(client_t *cl). list of plugins and modules then nothing to do. if you have a connection with the administration VALVE - give them a link to this topic...

[zbot1600]

delete message

[retribution]

I created this: http://forums.steampowered.com/forum...8#post13745468

maybe valve will do something to fix this vulnerability.

[Shockerul]

Originally Posted by retribution maybe valve will do something to fix this vulnerability.

Yea right, like they *not* fixed CSDoS/Born to be Pig, etc.

Anyways, I made a fix, http://www.shockingsoft.com/AntiCSDoS.html . Version 3.5 (released an hour ago) fixes this problem

Tested on:
- 47/1.1.2.5 3262
- 48/1.1.2.6 4554

[ehha]

Originally Posted by Shockerul Yea right, like they *not* fixed CSDoS/Born to be Pig, etc. Anyways, I made a fix, http://www.shockingsoft.com/AntiCSDoS.html . Version 3.5 (released an hour ago) fixes this problem Tested on: - 47/1.1.2.5 3262 - 48/1.1.2.6 4554

[retribution]

Okays theres new version of exploit so no more crabs. It wont protect your server.