Mojira Archive
MC-17023

Packet250CustomPayload StackOverFlowError

You can crash a server by sending a specially crafted Packet250CustomPayload. This is created by sending a large chain of NBTTagCompounds to the MC|BEdit channel. I used 100,000 of them which took down the default minecraft server but it would probably take much less.

The Data Portion of the packet comes in two parts

The first part is the header which is in the format of:
5 bytes of 0
2 bytes containing the length of the compressed portion

This is followed by the compressed portion. This is crafted by repeating a sequence of [10, 0, 0] into a GZIPOutputStream. The first byte is the id for NBTTagCompound and the second two bytes are the UTF representation of an empty string.

Once this is done you send this in a Packet250CustomPayload the channel MC|BEdit after the login process and the server will become unresponsive to clients. The connections will still exist but the server will not do any updating.

Attached is the binary format of the packet I used to crash the server and the crash log of the server after sending the packet.

I would like to say sorry for using MCP names for the classes but it is much easier to refer to them through those names than to use the obfuscated names.

I labeled this as SEVERE because as it now stands it can be used to cause a complete denial of service against most if not all servers

Fixed

Jacob Smith

[Mojang] Grum (Erik Broes)

2013-06-01, 10:47 AM

2015-08-04, 10:22 PM

2013-06-14, 12:48 PM

0

3

Unconfirmed

crash, multiplayer, server

Minecraft 1.5.2

Snapshot 13w24b