CVE-2017-20205
Description
Valve's Source SDK (source-sdk-2013)'s ragdoll model parsing logic contains a stack-based buffer overflow vulnerability.The tokenizer function `nexttoken` copies characters from an input string into a fixed-size stack buffer without performing bounds checks. When `ParseKeyValue` processes a collisionpair rule longer than the destination buffer (256 bytes), an overflow of the stack buffer `szToken` can occur and overwrite the function return address. A remote attacker can trigger the vulnerable code by supplying a specially crafted ragdoll model which causes the oversized collisionpair rule to be parsed, resulting in remote code execution on affected clients or servers. Valve has addressed this issue in many of their Source games, but independently-developed games must manually apply patch.
Summary dbcve.org
A stack-based buffer overflow exists in the Source SDK 2013's ragdoll model parser. The `nexttoken` function copies collisionpair rule data into a fixed 256-byte stack buffer (`szToken`) without bounds checking. When ParseKeyValue processes a collisionpair rule exceeding 256 bytes, the overflow can overwrite the function return address, enabling remote code execution.
Mitigation
Apply the bounds-checking patch to the `nexttoken` function in the ragdoll parsing code, or update to a Source SDK version that includes the official Valve patch. Verify all custom ragdoll models are from trusted sources.