Server crash caused by faulty find_nodes_in_area() implementation #165
Labels
No Label
blocker
bug
code quality
confirmed
critical
discussion
high priority
incompatibility
incomplete feature
invalid
low priority
missing feauture
needs testing
packet spam
performance
project
regression
translations
unconfirmed
in review
ready for review
No Milestone
No project
No Assignees
2 Participants
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: Mineclonia/Mineclonia#165
Loading…
Reference in New Issue
No description provided.
Delete Branch "%!s(<nil>)"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
What happened?
Oysterity crashed a number of times, reportedly while a player was teleporting out of bounds (under the world).
This first one they claim they can trigger on purpose:
This second one reportedly happened "not on purpose"
What did I expect?
I expected the game not to crash
How to get it to happen
Probably by teleporting out of bounds (a number of void deaths by the person seems to corroborate that).
Environment
Mineclonia Version: dadf35200a (supposedly all mcl versions are vulnurable to this though)
Minetest Version: 5.4.1
this is the relevant code in mods/ITEMS/mcl_fire/init.lua:310...
the distance between areamin and areamax is supposed to be constant (radius is defined as 8 in the file) so if this should become a problem I might just check for that.
Turns out the volume calculation done by
minetest.find_nodes_in_area()
is actually incorrect.Server crash caused by out of bounds playersto Server crash caused by faulty find_nodes_in_area() implementationluatic from #minetest IRC suggested that the volume calculation chokes on any coordinates exceeding s16 bounds. I can prove this with the following code, the new
areatest
command crashes Minetest:Sounds about right. I actually tested sth similar earlier. So o propose to add a is_in_bounds(pos) function in MCL_worlds and it before every find_nodes_in_area
Its not like there s anything to be found outside of thay
I have opened an issue on Minetest, titled “find_nodes_in_area() volume calculation is off by about four million nodes, enabling remotely-triggerable server crashes”:
https://github.com/minetest/minetest/issues/11769
How about we overwrite find_nodes_in_area with our own version that contains boundary checks though?
I'll test this.
Well maybe both. That check function might come in handy at other places
New info from testing:
To crash the server, something needs to be bigger than the s16 bounds (-32768, 32767).
To not immediately crash it, but hang it at shutdown, you have to exactly hit the s16 bounds.
Well find_nodes makes no sense out of map bounds so we can safely just not do it I think
I may have a fix. Note that I advocate clamping the coordinates for the calculation here only because it is arguably correct to say that there are no nodes there … except if you want to read server RAM from Lua, maybe?
Uhh this seems unnecessarily complex (and technical) not sure I even understand it fully lol. I'd just check if the coords are within map bounds and else return an empty array tbh
Ill have a counter proposal later which I almost finished this morning
As I said in chat, that fails when the volume is partially out of bounds.
I found out exactly how to trigger it but I will not post publicly for crashbutton reasons.
EDIT: how to trigger both of them*
@cora do these three work? If so, is there a difference in runtime?
the results of the different /areatests vary a lot: they were between 1.2 and 1.8 and 1 mostly seemed to be the fastest but it was also the slowest sometimes.
fixed by #169