####################################################################### Luigi Auriemma Application: Stronghold 2 http://www.stronghold2.com Versions: <= 1.2 Platforms: Windows Bug: exception/crash Exploitation: remote, versus server Date: 30 May 2005 Author: Luigi Auriemma e-mail: aluigi@autistici.org web: http://aluigi.altervista.org ####################################################################### 1) Introduction 2) Bug 3) The Code 4) Fix ####################################################################### =============== 1) Introduction =============== Stronghold 2 is a stategic game developed by Firefly Studios (http://www.fireflyworlds.com) and published by 2K Games (http://www.2kgames.com). It has been released in April 2005. ####################################################################### ====== 2) Bug ====== In the packet used for joining the server is locatd the client's nickname preceded by a 32 bit number used to specify its size. When the server receives the packet it reads this number and allocates that amount of memory where, then, will be copied the nickname. The problem is that the STLport library fails to allocate a too big amount of memory and generates an exception that terminates the game. ####################################################################### =========== 3) The Code =========== http://aluigi.altervista.org/poc/strong2boom.zip ####################################################################### ====== 4) Fix ====== No fix. No reply from the vendor. ####################################################################### --- Luigi Auriemma http://aluigi.altervista.org