This topic was archived here:

https://web.archive.org/web/20230000000000fw_/https://www.zenhax.com/viewtopic.php?t=932

maraakate, posted Sat May 09, 2015 7:20 pm (5159)

---

Hello, I know this is an older exploit but I am curious as to what caused it. Was the name being sent over a specific internal string in the game, some sort of buffer overflow with the name being longer, etc?

aluigi, posted Sat May 09, 2015 7:37 pm (5160)

---

http://aluigi.org/adv/csdos.txt

maraakate, posted Sun May 10, 2015 1:25 am (5166)

---

Ah yes, I've come across similar issues getting stuck in Info_ValueForKey loops in Daikatana. Thanks! One interesting one in particular (and may exist in Quake 2) is if the key is longer than 64 chars (the MAX_INFO_KEY value) then it is truncated and you can set null names, model names, etc. Depending on later checks in the userinfo changed code it can crash servers.

aluigi, posted Sun May 10, 2015 4:04 pm (5187)

---

Eh, the good old times

maraakate, posted Sun May 10, 2015 7:04 pm (5197)

---

In the Daikatana 1.3 project I've been working on with a few other people your tools have been great at finding potential flaws like this.