[General] Limit maximum imageData size in WorldMap packets

apps/openmw-mp/Script/Functions/Worldstate.cpp

@@ -59,7 +59,16 @@ void WorldstateFunctions::LoadMapTileImageFile(int cellX, int cellY, const char*
     std::ifstream inputFile(filePath, std::ios::binary);
     mapTile.imageData = std::vector<char>(std::istreambuf_iterator<char>(inputFile), std::istreambuf_iterator<char>());
 
-    writeWorldstate.mapChanges.mapTiles.push_back(mapTile);
+    if (mapTile.imageData.size() > mwmp::maxImageDataSize)
+    {
+        LOG_MESSAGE_SIMPLE(Log::LOG_ERROR, "Error loading image file for map tile: "
+            "%s has a size of %i, which is over the maximum allowed of %i!",
+            filePath, mapTile.imageData.size(), mwmp::maxImageDataSize);
+    }
+    else
+    {
+        writeWorldstate.mapChanges.mapTiles.push_back(mapTile);
+    }
 }
 
 void WorldstateFunctions::SetHour(double hour) noexcept

components/openmw-mp/Base/BaseWorldstate.hpp

@@ -9,6 +9,8 @@
 
 namespace mwmp
 {
+    static const int maxImageDataSize = 1400;
+
     struct MapTile
     {
         int x;

components/openmw-mp/Packets/Worldstate/PacketWorldMap.cpp

@@ -1,4 +1,5 @@
 #include <components/openmw-mp/NetworkMessages.hpp>
+#include <components/openmw-mp/Log.hpp>
 #include "PacketWorldMap.hpp"
 
 using namespace std;
@@ -31,17 +32,25 @@ void PacketWorldMap::Packet(RakNet::BitStream *bs, bool send)
         RW(mapTile.x, send);
         RW(mapTile.y, send);
 
-        uint32_t imageDataCount;
+        uint32_t imageDataSize;
 
         if (send)
-            imageDataCount = static_cast<uint32_t>(mapTile.imageData.size());
+            imageDataSize = static_cast<uint32_t>(mapTile.imageData.size());
 
-        RW(imageDataCount, send);
+        RW(imageDataSize, send);
+
+        if (imageDataSize > mwmp::maxImageDataSize)
+        {
+            LOG_MESSAGE_SIMPLE(Log::LOG_ERROR, "Processed invalid ID_WORLD_MAP packet where tile %i, %i had an imageDataSize of %i",
+                mapTile.x, mapTile.y, imageDataSize);
+            LOG_APPEND(Log::LOG_ERROR, "- The packet was ignored after that point");
+            return;
+        }
 
         if (!send)
         {
             mapTile.imageData.clear();
-            mapTile.imageData.resize(imageDataCount);
+            mapTile.imageData.resize(imageDataSize);
         }
 
         for (auto &&imageChar : mapTile.imageData)