Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
egametang/et
master @ 5cab01f
10
Fixes
0
CVEs
HIGH
Peak severity
Highlights
Denial of Service: 8 prior fixes. Scrutinize any change in this area.
Unity/Assets/Scripts/Entity/Session.cs: most-fixed (3 issues). Treat as high-risk during review.
4 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Denial of Service: Unbounded packet sizes parsed from incoming streams allow remote attackers to allocate massive buffers, causing rapid heap exhaustion and crashing either the client or server. Strict length validations must be applied immediately upon header resolution.
Input Validation: Failure to safely catch parsing errors during deserialization allows malformed messages to trigger unhandled exceptions, leading to application termination or logical bypasses. Offending sessions must be explicitly terminated immediately when parsing fails.
Use After Free: Asynchronous network callbacks executing after session removal can access freed session structures. Session destruction must be strictly deferred until all pending async operations and callbacks complete.