Uploaded image for project: 'Minecraft: Java Edition'
  1. Minecraft: Java Edition
  2. MC-269452

Crash when using item modifier with replace_section mode and very large size field

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Fixed
    • 24w12a
    • 24w11a
    • None
    • Plausible
    • Crash, Data Packs
    • Very Important
    • Platform

      Summary
      Three new item modifiers/loot functions, set_fireworks, set_written_book_pages, and set_writable_book_pages, all use similar formats for modifying lists. One of the mode s that can be specified is replace_selection, which further allows specifying offset and size fields. These fields are non-negative integers. Although offset is validated to never exceed the current values' size - which is at most 256 in the case of fireworks - size's value is not validated.

      By specifying very high size value and non-zero offset, an integer overflow can be triggered in the code calculating the list index, causing a crash.

      Note that triggering this crash requires that the list have at least one entry (explosion or page), otherwise offset fails to validate. The attached data pack first adds one explosion, then calls the problematic loot function, to trigger the crash.

      Steps to Reproduce

      1. Add the attached data pack.
      2. Kill a creeper. Note: the game catches any exception caught during player action, so use lava or other non-player damages to test the crash.

      Expected Result
      One firework rocket drops, and the game does not crash.

      Actual Result
      The game crashes.

      Code Analysis (24w11a)
      In epn$d#a, we find this piece of code:

      int k = this.offset + ((Integer)this.size.orElse(Integer.valueOf(list2.size()))).intValue();
      if (k < j) builder.addAll(list.subList(k, j)); 
      

      In the example data pack, offset is 1 and size is 2147483647 (Integer.MAX_VALUE). Adding that makes k -2147483648. j is the size of the current value; since k is negative, k < j is always true. This calls List#subList with a negative integer as the start index, causing a crash.

        1. crash-2024-03-15_19.59.25-server.txt
          7 kB
          apple502j
        2. deobf_crash-2024-03-15_19.59.25-server.txt
          23 kB
          [Bot] Arisa
        3. latest.log
          11 kB
          apple502j
        4. Minecraft 24w11a - Singleplayer 2024-03-15 19-59-17.mp4
          3.79 MB
          apple502j

            slicedlime [Mojang] slicedlime
            apple502j apple502j
            Votes:
            1 Vote for this issue
            Watchers:
            0 Start watching this issue

              Created:
              Updated:
              Resolved:
              CHK: