Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[3.x] [Net/ENet] Better handle truncated socket messages #79704

Merged
merged 2 commits into from
Aug 2, 2023

Conversation

Faless
Copy link
Collaborator

@Faless Faless commented Jul 20, 2023

Update ENet to latest upstream master branch (ea4607a90dbfbcf4da2669ea998585253d8e70b1 at the time of the PR), plus lsalzman/enet@2a85cd6 , which fixes a DoS vulnerability in ENet library code originally discovered by @Facundo15 and reported to the Godot Security Team.

The fix is included in 4.0.4, 3.5.3, and 4.1.2, and all 4.2 beta releases.

See #79699 for the 4.x version.

@Faless Faless added bug topic:network cherrypick:3.5 Considered for cherry-picking into a future 3.5.x release topic:multiplayer labels Jul 20, 2023
@Faless Faless requested review from a team as code owners July 20, 2023 11:52
@Faless Faless added this to the 3.6 milestone Jul 20, 2023
Copy link
Member

@akien-mga akien-mga left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks great!

@akien-mga akien-mga merged commit e345fde into godotengine:3.x Aug 2, 2023
13 checks passed
@akien-mga
Copy link
Member

Thanks!

@akien-mga
Copy link
Member

Cherry-picked for 3.5.3.

@akien-mga akien-mga removed the cherrypick:3.5 Considered for cherry-picking into a future 3.5.x release label Aug 18, 2023
@jasonwinterpixel
Copy link
Contributor

jasonwinterpixel commented Oct 22, 2023

I review the changelog before we merge upstream into our products. I request that a description is always written for a pull request like this.

@AThousandShips
Copy link
Member

AThousandShips commented Oct 22, 2023

You are free to ask that, but this is not a polite, or constructive, way of providing feedback or criticism, please read the code of conduct.

The PR title and the commit titles are very descriptive of what is going on. Exactly two files were changed, doing exactly what the PR title says, handling truncated messages.

@jasonwinterpixel
Copy link
Contributor

Serious question, how would you write it to be more polite?

@AThousandShips
Copy link
Member

AThousandShips commented Oct 23, 2023

First of all I first saw your very first message, before you edited it, which I think we can all agree was neither productive nor polite, I am sorry if my initial reaction was harsh, but your first response set me off

But as I said, and though I understand your position, the way the message reads do me is demanding, so I'd suggest to approach it with a tone like "I'd like it if" or "I'd appreciate it if", as opposed to putting demands on the work of others, but language is complicated and perhaps the original intent does not always carry through in text, which I understand. Though I'd say that the more constructive way to communicate this is in other channels, rather than on a PR

Have a nice day

If we agree that this has been resolved we can mark these messages as off-topic

@Faless
Copy link
Collaborator Author

Faless commented Oct 23, 2023

@jasonwinterpixel the two PRs were originally under embargo, waiting to be applied in an official release, I have correctly updated the description now.

@jasonwinterpixel
Copy link
Contributor

Thank you for updating the description. I will commence investigating to see if we are affected by any relevant security issues.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants