Verify EmotePacket entity id & ignore if player is not spawned (Cloud…

…burstMC#1891) (cherry picked from commit f77abc5)
NetEasePE · Dec 23, 2021 · 4768d69 · 4768d69
1 parent c1afb31
commit 4768d69
Showing 1 changed file with 9 additions and 1 deletion.
diff --git a/src/main/java/cn/nukkit/Player.java b/src/main/java/cn/nukkit/Player.java
@@ -2289,8 +2289,16 @@ public void onCompletion(Server server) {
                     log.warn("Violation warning from {}: {}", this.getName(), packet.toString());
                     break;
                 case ProtocolInfo.EMOTE_PACKET:
+                    if (!this.spawned) {
+                        return;
+                    }
+                    EmotePacket emotePacket = (EmotePacket) packet;
+                    if (emotePacket.runtimeId != this.id) {
+                        server.getLogger().warning(this.username + " sent EmotePacket with invalid entity id: " + emotePacket.runtimeId + " != " + this.id);
+                        return;
+                    }
                     for (Player viewer : this.getViewers().values()) {
-                        viewer.dataPacket(packet);
+                        viewer.dataPacket(emotePacket);
                     }
                     return;
                 case ProtocolInfo.PLAYER_INPUT_PACKET: