Fixed infinite loop in deserializeCharacterData

Could happen on servers where a character is being communicated that has
something equipped.

The infinite loop was due to using "while (msg.getUnreadLength())" on a
message after having read one byte too much, causing it to miss the 0
bytes unread and count to minus infinity. This is a danger that we
should probably also fix generally.

The byte that was read too much was equipmentInSlotType, which I think
should have been the number of items equipped in a certain slot type.
This number is never written by the serializeCharacterData function and
also doesn't seem necessary. When multiple items are equipped in a
single equipment slot type, there will simply be multiple pairs
transmitted for that equipment slot type.

Reviewed-by: Freeyorp

1 files changed, 5 insertions, 10 deletions

diff --git a/src/serialize/characterdata.h b/src/serialize/characterdata.h
index 203f4a7..4466c98 100644
--- a/src/serialize/characterdata.h
+++ b/src/serialize/characterdata.h
@@ -190,14 +190,10 @@ void deserializeCharacterData(T &data, MessageIn &msg)
     unsigned int eqSlot, invSlot;
     for (int j = 0; j < equipSlotsSize; ++j)
     {
-        int equipmentInSlotType = msg.readInt8();
-        for (int k = 0; k < equipmentInSlotType; ++k)
-        {
-            eqSlot  = msg.readInt8();
-            invSlot = msg.readInt16();
-            poss.equipSlots.insert(poss.equipSlots.end(),
-                                   std::make_pair(eqSlot, invSlot));
-        }
+        eqSlot  = msg.readInt8();
+        invSlot = msg.readInt16();
+        poss.equipSlots.insert(poss.equipSlots.end(),
+                               std::make_pair(eqSlot, invSlot));
     }
     poss.inventory.clear();
     // inventory - must be last because size isn't transmitted
@@ -209,7 +205,6 @@ void deserializeCharacterData(T &data, MessageIn &msg)
         i.amount   = msg.readInt16();
         poss.inventory.insert(poss.inventory.end(), std::make_pair(slotId, i));
     }
-
 }
 
-#endif
+#endif // SERIALIZE_CHARACTERDATA_H