All files
patches/HXA-2026-003-netgameeventv2-bounds-check.diff
# HXA-2026-003 — bounds-check the client-controlled player index before the bitset access## Defensive patch. Adds the missing range check so a client-supplied targetPlayers value# can no longer index outside the `processed` bitset. A rate limiter in line with the# neighbouring handlers is recommended as a second layer. --- a/code/components/citizen-server-impl/src/packethandlers/NetGameEventPacketHandler.cpp+++ b/code/components/citizen-server-impl/src/packethandlers/NetGameEventPacketHandler.cpp@@ ProcessNetEvent for (const uint16_t player : targetPlayersSpan) {+ // Reject out-of-range indices before they reach the bitset. `player` is fully+ // client-controlled (0..65535); the bitset is only sized for MAX_CLIENTS.+ if (player >= MAX_CLIENTS)+ {+ continue;+ }+ if (processed.test(player)) { continue; } processed.set(player);