Players can set negative bundle selected stack indices through packets
If a player is holding a non-empty bundle and sends a specially-crafted packet (via a client mod to a vanilla server) with a selected item index of -2 or less, then attempts to throw the items out of the bundle, that player will disconnect with a stack trace indicating out-of-bounds index array access.
While this doesn't seem to have any clear crash or duplication potential for servers, the ability to disconnect a player on use, causing an error in the server log, in addition to the fact that this property will persist when given to other players until the bundle stack is serialized and deserialized or scrolled, makes me believe that this is a valid bug report.
The following code (Yarn mappings) will send the packets necessary to produce the issue:
public static boolean attemptCrash(ClientPlayerEntity player) { PlayerInventory inventory = player.getInventory(); int slot = inventory.selectedSlot; ItemStack stack = inventory.getStack(slot); if (stack.isIn(ItemTags.BUNDLES)) { OptionalInt screenHandlerSlot = player.currentScreenHandler.getSlotIndex(inventory, slot); if (screenHandlerSlot.isPresent()) { player.networkHandler.sendPacket(new BundleItemSelectedC2SPacket(screenHandlerSlot.getAsInt(), -2)); player.networkHandler.sendPacket(new PlayerInteractItemC2SPacket(Hand.MAIN_HAND, 0, 0, 0)); } return true; } return false; }
2025-01-04, 09:52 AM
2025-01-07, 04:28 PM
2025-01-07, 04:28 PM
0
1