Skip to content

Fix integer overflow in trade money calculation#319

Open
kwsantiago wants to merge 1 commit intoOpenFusionProject:masterfrom
kwsantiago:fix/trade-money-overflow
Open

Fix integer overflow in trade money calculation#319
kwsantiago wants to merge 1 commit intoOpenFusionProject:masterfrom
kwsantiago:fix/trade-money-overflow

Conversation

@kwsantiago
Copy link

Summary

The trade confirmation handler computes new money balances using int32_t arithmetic:

plr->money = plr->money + plr2->moneyInTrade - plr->moneyInTrade;

Since money and moneyInTrade are both int32_t, the intermediate sum can overflow, allowing players to end up with negative or wrapped-around money values. A crafted trade can exploit this for money duplication.

What changed

  • Compute new balances using int64_t before committing
  • Validate that neither player is offering more money than they have
  • Validate that resulting balances are within [0, INT32_MAX]
  • Abort the trade cleanly if any check fails

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant