Crash Exploit - Can force clients to crash!
In Mojang's authlib version 1.5.22 there is a bug which if taken advantage of can force other players on a server to crash.
How to reproduce bug:
Dropping a skull which contains the NBT Tags
SkullOwner:{Id:"00000000-0000-0000-0000-000000000000",Properties:{textures:[{Value:""}]}}}
The bug is located in the library file 'authlib' in the class 'YggdrasilMinecraftSessionService' under the method 'getTextures', My current theory is that when processing the MinecraftTexturePayload from Json it returns null, 'result.getTextures()' is where I believe the issue is, there is no check if the result is null in the authlib code.
I was able to fix this issue by simply checking if 'result == null'
Once patch I'm able to hold the item and drop it causing nearby clients to crash.
I was also able to replicate this command into a forge mod(Means I don't require a command block) where on a vanilla server I was able to give myself this skull(As long as I'm in creative mode) and drop it causing all clients attempting to render the dropped item to crash.
It should also be noted that just by holding the skull it cause other clients to see some very weird stuff, Check attached files
Just noticed that clients will also get spammed with the error below if while a player is holding the skull
http://pastebin.com/rak6QjhY
2016-07-04, 09:34 AM
2016-10-01, 08:39 AM
2016-07-05, 10:02 AM
0
2
-