Packet250CustomPayload(dk) contains a minor bug with sending data sizes of exactly 32767. It will create and send the packet just fine but the problem comes with reading the packet.
While creating the packet it checks if the length is greater than 32767. If you send data of exactly 32767 this passes. While reading it checks if the length is greater than 0 and less than 32767. It is now invalid.
This causes the packet to not read in the data portion of the packet and the remaining portion of the packet will now be read as a separate packet which usually causes the client to be disconnected
Attachments
Comments 7
Let's see... This is the 16910th issue, and the tracker opened back in October. That makes for an average of 76 issues per day. 1815 issues have been created since this one was, for an average of 62 issues created per day. It's a little hard to keep up with that kind of traffic.
Thus, Mojang has appointed mods to patrol the tracker, and triage issues, filtering out the majority of the invalid, duplicate, etc., so the Minecraft developers can spend their time more efficiently. They probably mostly look at issues that are already confirmed. However, I doubt the mods are as familiar with the code as the Minecraft developers, and this issue is written in terms of code, rather than actions the player can perform and its consequences.
Packet250CustomPayload() was created primarily for Bukkit. It exists in the vanilla Minecraft code, but I don't believe it is used for anything. Also, according to Dinnerbone's post about it, the message should be less than 32767, not less than or equal. The maximum length is 32766.
This puts this issue in kind of a weird spot. It requires a mod to trigger a problem, and they don't really support mods yet. But it was implemented specifically so that mods could use it, similar to the various things Dinnerbone has implemented since joining Mojang that require external NBT editing tools to make use of. It should probably be brought to his attention. The problem is that most people aren't going to encounter the bug, or know that this is the cause. Thus, the mods aren't going to have any reason to confirm it, whether through personally encountering it, or through community consensus.
You know I was expecting a response similar to this. Anyways thanks for the response. Nice to know these are getting read.
Currently that Packet is used in vanilla minecraft for Server textures, Setting the CommandBlock command, Writing and signing books, Setting beacon effects, and for setting the name of an item in an anvil. The only ones I see potentially causing this in vanilla minecraft would be Server textures and book editing. The others the gui should restrict it before the packet even gets created.
This is all looking through 1.5.2 so I am not sure if it used any more in the snapshots. I will check though
Oh, so they have made use of it since implementing it. That's interesting, and might provide a line of reproduction. Server textures are currently in limbo, with the changeover to resource packs. According to the wiki, the command block is limited to 254 characters, and it's hard to imagine what a functional command of the necessary length would look like. The beacon and anvil have similarly short useful lengths. Sounds like the easiest one would be a book, since there are plenty of sources of sufficient text (though random characters would work just as well).
And I found a reproducible way. Using the config I uploaded it provides a texture-pack that creates the exact length of 32767 when sent to the client. This causes the crash report found also uploaded. Yes I do realize that the texture pack of 32764 a's does not exist but it does still work
I figured the book would work well too, but after reading up on it on the wiki it only allows 50 pages of 256 characters. Which I don't think would be enough to reach the limit. Mods could allow a greater range of pages or characters but that would only disconnect the client.
How has this not been confirmed or fixed in almost a month? I know it's not a huge problem but it is a very easy fix. All it needs is an equals sign in one of two possible places.