Mojira Archive
MC-249836

Freeze server with container click packet while lectern open

We got a report of someone freezing a server and this was the watchdog stack trace https://mclo.gs/NVb50oI. We also got a screenshot of the setup this guy was using.

The issue seems to be in AbstractContainerMenu#doClick.

for(ItemStack var14 = this.quickMoveStack(param3, param0); !var14.isEmpty() && ItemStack.isSame(var13.getItem(), var14); var14 = this.quickMoveStack(param3, param0)) {
} 

and specifically with the Lectern because the LecternMenu is the only menu impl that doesn't override quickMoveStack with its own logic. That for loop will loop infinitely if run in a LecternMenu since it doesn't mutate any containers.

 

So in short, the client can send the ServerboundContainerClickPacket with a ClickType of "QUICK_MOVE" while the player has a lectern open (using a modified client ofc, as you that's not vanilla behavior) and the server will sit in that loop forever.

 

EDIT #1:

I was able to reproduce it on a fully vanilla server editing and resending packets with https://github.com/Heath123/pakkit. Server just totally locks up. I've attached the crash report that followed.

 

EDIT #2:

Also reproducible on 22w13a. I used a fabric mod that simple runs

int button = 0
int slot = 0;
Int2ObjectMap<ItemStack> modified = new Int2ObjectOpenHashMap<>();
modified.put(0, ItemStack.EMPTY);
modified.put(62, Items.ITEM_FRAME.getDefaultInstance());
final ServerboundContainerClickPacket packet = new ServerboundContainerClickPacket(minecraft.player.containerMenu.containerId, minecraft.player.containerMenu.getStateId(), slot, button, ClickType.QUICK_MOVE, ItemStack.EMPTY, modified);
minecraft.getConnection().send(packet); 

1.5 seconds after typing ".lectern" in the chat. Just sends the quick move packet with some arbitrary content.

Fixed

Jake Potrebic

2022-04-02, 06:17 AM

2022-04-21, 11:01 AM

2022-04-21, 11:01 AM

1

1

Plausible

Very Important

Crash

1.18.2

22w17a