Chunk data overflow
Written books can be exploited to bloat a chunk's NBT to the point where the chunk cannot be saved. This is being exploited on some servers to duplicate items. Players are creating large written books full of Unicode characters that do not compress well, and then placing them in chests to bloat the chunk's NBT. It is then a simple matter to duplicate items.
Attached is a small save file that demonstrates the exploit. When written books in the dark oak chest are placed back in the chest singly in an alternating pattern, the player can force the chunk not to save. It is possible to duplicate every item in the chunk by transferring all such items to another chunk and then triggering the exploit.
The issue exists in Minecraft 1.8, and is suspected to exist as far back as Minecraft 1.3.1.
The issue has two causes.
1. The data for written books are saved in the chunk instead of being stored separately.
2. The Anvil file format cannot save a chunk that is larger than 1,044,480 bytes after compression. When this happens, nothing appears in the logs.
The combination of these two issues produces the exploit.
Suggested fixes:
1. Move the data for written books out of the chunk into a separate location, similar to how maps currently work. This removes the current trigger but it doesn't fix the bug that is the cause of the exploit.
2. Eliminate future exploits of this kind by fixing the Anvil bug where over-large chunks cannot be saved. Two possible fixes:
2.1: Reinterpret a chunk length in the Anvil headers of 255 to mean 255 or more. If the chunk length field is 255, the actual length of the chunk can be retrieved from the chunk data. The length is already stored in the first four bytes of chunk data, so no change to the Anvil file format is necessary. However, some low-level changes to file handling will probably be required.
2.2: Rearrange the Anvil file format by taking the full chunk length out of the first four bytes of chunk data and transferring it to the header. The header would then be 4 bytes for length and 4 bytes for offset. This would no longer be an Anvil file.
Notes:
This is related to MC4001.
2019-02-18, 08:48 AM
2019-09-05, 08:56 AM
2019-02-18, 03:35 PM
0
0
-