GHSA-8cwq-4cmf-px73
PocketMine-MP invalid skin geometry JSON data leading to server crash
Quick fix
GHSA-8cwq-4cmf-px73 — pocketmine/pocketmine-mp: upgrade to the fixed version with the command below.
composer require pocketmine/pocketmine-mp:^4.7.2Details
### Impact `pocketmine\entity\Skin` doesn't correctly handle errors produced by `adhocore/json-comment`, which throws `RuntimeException` rather than returning `false` as PocketMine-MP expects.
This leads to a server crash if the skin geometry data is invalid for some reason (e.g. a syntax error).
### Patches c9626c610b8f6810c8c987559c9197b2a291f0bb
### Workarounds A plugin could handle `LoginPacket` and `PlayerSkinPacket` to verify the skin geometry data can be parsed correctly, so that the error condition in the core code is never reached.
### For more information If you have any questions or comments about this advisory: * Email us at [security@pmmp.io](mailto:security@example.com)
Are you affected?
Enter the version of the package you're using.
Affected packages
0Fixed in: 4.7.2composer require pocketmine/pocketmine-mp:^4.7.2