User:Taffer

From OuroDev
Revision as of 08:11, 4 May 2019 by Taffer (talk | contribs)

Being a place for notes about my investigation into the code. I'm focusing on security.

General

What are these _test folders for? Not unit tests (lulz of course not), just one project file...

3rdparty

  • zlib woefully out of date; have a pull request already in place to update it to current
  • Crypto++ woefully out of date
  • OpenSSL is ancient and needs to be updated ASAP to a supported version. What references OpenSSL?
    • arda2 in AuthServer
    • any others?

I need to look at the rest of the libs, and also figure out what's used where. Only a few things get built during a build (zlib, Crypto++, zeromq, IJG, yajl), maybe.

AuthServer

  • Doesn't appear to use any of the external/* libs. Arda2 appears to reference them though at least in the Linux Makefile.
  • cryptLib is a SHA512 implementation; it may be specific to AuthServer messages. It should be replaced by calls to OpenSSL or Crypto++ as they'll be faster and bug-free. Yes, three implementations of SHA-512.
  • Need to make it use zlib, etc. from 3rdparty instead of the local duplicates so we can upgrade things sanely.

Game

  • Looked in game.c, oh dear there's a lot of unsafe string handling going on in this code base...