Bug#1031732: iortcw: CVE-2019-25104

[Simon McVittie]

On Tue, 21 Feb 2023 at 16:09:30 +0100, Moritz Mühlenhoff wrote:
> CVE-2019-25104[0]:
> https://github.com/rtcwcoop/rtcwcoop/pull/45

This looks like a denial of service via memory exhaustion when running
a multiplayer server. For a game from 2001, I would personally say this
is normal or even minor severity: it isn't really realistic to expect
a game this old to not be crashable.

I'm also not at all sure that iortcw is even vulnerable to this.

For historical reasons iortcw is actually two separate game engines with
similar but divergent content: SP/ is a single-player game with
computer-controlled enemies and no real security implications, while
MP/ is a team-based competitive multiplayer game with only human players.

rtcwcoop appears to be a fork of iortcw which combines the SP and MP
codebases, so that gamers can play the original game's single-player story
as a cooperative multiplayer game where they fight computer-controlled
enemies.

This denial of service seems to be in code to load AI scripts for
computer-controlled enemies or allies, which can happen in rtcwcoop
or in iortcw SP/; but iortcw MP/ doesn't have any computer-controlled
characters as far as I know, so it might well be impossible for the
resource exhaustion to actually happen in practice?

    smcv