James Cameron

An out-of-bounds read occurs in the `handleSMessage()` function within short.c. This issue allows a malicious server or an attacker intercepting the plaintext TCP connection to cause a client crash by sending SP S MESSAGE packets where the `m recpt` index is 36 or greater. This results in the system reading beyond the `players[]` and `shipnos` arrays, leading to a denial of service.

A stack-based buffer overflow exists in the `handleSMessage()` function within short.c. This issue occurs when the client processes oversized SP S MESSAGE packets, allowing a malicious server or a man-in-the-middle attacker on a plaintext TCP connection to overflow a 100-byte stack buffer. By sending overlong or unterminated message bodies, an attacker can write controlled bytes onto the stack, leading to a client crash.