Dismounting entities have race condition allowing players to be teleported within a block
The fix for MC-260632 has introduced a race condition allowing for the client to teleport within a block when they dismount an entity, such as a boat, right as the server sends the teleport packet. Teleporting within a block may also let the player phase through said block.
Do note that even though I mention mods later, this is possible in Vanilla; the mods just made it far easier to get to the root cause by having special behaviour and being able to give insight into the networking layer.
It is possible to reproduce this on both the client and server.
- The client is easiest with limiting the FPS to 10.
- The server has no known easiest route with a vanilla client.
Steps to Reproduce
1. Get a boat & place it on the ground towards a wall.
2. Spam sneak & 'use'/right-click the boat
3. Eventually manage your way into the ground.
Technical
Gadget packet dump of this bug in action.
All naming here are with Yarn. I should note, this was originally performed with a modded entity as it was the easiest to reproduce the bug with due to its behaviour.
However, I did manage to get Vanilla 1.20.1 to also phase me into the ground, so it is possible, but far more tricky due to the boat's hit box and player placement.

What goes on is that when the server sends the RequestTeleport packet, it sets the last teleport position in the PlayerNetworkHandler to then set the position again on ACK/Confirm.
However, this does mean that there's a very short window in Vanilla that the client can send a dismount before ACK'ing the teleport and allow itself to phase through blocks immediately after. This will be even easier with a hacked client as the Vanilla server currently provides no timeout, only that there was no teleport sent after and that it wasn't already acknowledged.
A potential solution
As I have implemented in Polysit v0.4.1 to work around this newly introduced bug, I made the server request teleport again on dismounting, invalidating the last teleport request and making it impossible for it to phase through blocks.
// ServerPlayerEntity
public void requestTeleportAndDismount(double x, double y, double z) {
this.dismountVehicle();
this.setPosition(x, y, z);
// New line to add after ServerPlayerEntity.java:978 off the v1.20.1 branch:
this.requestTeleport(x, y, z);
}
2023-06-24, 03:51 AM
2024-11-21, 02:01 PM
2024-11-21, 02:01 PM
1
2
-