What it fixes?

* Negative lengths can no longer move read/write pointers backwards.

- Invalid lengths cannot reach memcpy/memmove.
- Reads cannot copy more bytes than the live buffer contains.
- Integer addition is checked before computing a new allocation size.
- Consumed space at the front is reused before growing the allocation.
- Reallocation copies live bytes only, reducing unnecessary copying.
- The pool-index loop avoids signed `1 << 31` undefined behaviour.

File > libthecore/src/buffer.c

Search for :



Add this directly below it:



Search inside both buffer_get_pool_index and buffer_get_exac_pool_index :



Replace both with:



Search for :



Add this at the start of the function:



Search for :



Replace the complete function with:



Search for :



Replace the complete function with:



Search for these three complete functions :



Replace them with:



Search for :



Make sure the function starts with:



Search for :



Replace the complete function with:



Search for :



Replace the complete function with:



Search for :



Replace the complete function definition with:



File > EterLib/NetStream.cpp

Search for :



Replace both complete functions with:



Search for :



Add this at the start of the function:



Add this after the m_sendBuf and m_sendTEABuf allocations:



Search inside CNetworkStream::CNetworkStream :



Use these three initializers:



Search for :



Add this at the start:



Search for :



Add this at the start:



Search for :



Replace its validation/copy beginning with:



Search for every "if (recvSize < 0)" inside :



Use this in all three receive branches:



File > UserInterface/PythonNetworkStream.cpp

Search for :



Add this directly after it:



File > UserInterface/Packet.h

Search for :



Use these instead:



File > UserInterface/PythonNetworkStreamPhaseHandShake.cpp

Search for :

Replace the complete function with:

Search for :

Replace the complete function with:


File > UserInterface/AccountConnector.cpp

Search for :

Replace the complete function with:

Search for :

Replace the complete function with:

Search inside CAccountConnector::__AnalyzeVarSizePacket :

Add this directly below it:


File > UserInterface/GuildMarkDownloader.cpp

Search for :



Add this after the initial fixed-header Peek:



Add this before the block loop:



Validate each compressed block with:



Add this after the loop:



Search for :



Add this before subtracting the fixed header: