Players are sent chunk data for chunks they shouldn't be able to see
If there is block update, light update, or chunk load/unload far enough away so that multiplication gets overflowed, this chunk data would be sent to clients that cannot see this area. Because the server only send this information for chunks that are actually loaded, this can provide a serious advantage on competitive servers, since the server is effectively giving out the locations of online players.
Reproduction Steps
Unlisted video demonstrating these steps: https://youtu.be/uvCNcuZCBC4
- Spin up a 1.18.1 server with default settings.
- Join the server with two accounts.
- Leave account one at spawn, and teleport the other account away (in this example I teleported to around 1000000, 0).
- Watch the logs of the instance left at spawn for warning messages containing the chunk coordinates:
... [14:25:03] [Render thread/WARN]: Ignoring chunk since it's not in the view range: 62500, -16 [14:25:03] [Render thread/WARN]: Ignoring chunk since it's not in the view range: 62499, -16 [14:25:03] [Render thread/WARN]: Ignoring chunk since it's not in the view range: 62498, -16 [14:25:03] [Render thread/WARN]: Ignoring chunk since it's not in the view range: 62501, -16 [14:25:04] [Render thread/WARN]: Ignoring chunk since it's not in the view range: 62503, -4 [14:25:04] [Render thread/WARN]: Ignoring chunk since it's not in the view range: 62498, -4 ...
These coordinates can then be multiplied by 16 to get the "regular" world coordinates, 1000016,-64
Expected behavior
These chunk data would not be sent to the client.
Potential Fix
This has been fixed in Paper; see the commit.
This was discovered by nag1bator228 on the Paper discord, full credit for the discovery to them.
2021-12-29, 01:40 PM
2022-01-19, 03:13 PM
2022-01-19, 03:13 PM
0
2