Sanitize player position and speed server-side (#12396)

2 files changed, 10 insertions, 4 deletions

diff --git a/src/server/player_sao.cpp b/src/server/player_sao.cpp
index d076d5783..27759ba9d 100644
--- a/src/server/player_sao.cpp
+++ b/src/server/player_sao.cpp
@@ -319,8 +319,14 @@ std::string PlayerSAO::generateUpdatePhysicsOverrideCommand() const
 	return os.str();
 }
 
-void PlayerSAO::setBasePosition(const v3f &position)
+void PlayerSAO::setBasePosition(v3f position)
 {
+	// It's not entirely clear which parts of the network protocol still use
+	// v3f1000, but the script API enforces its bound on all float vectors
+	// (maybe it shouldn't?). For that reason we need to make sure the position
+	// isn't ever set to values that fail this restriction.
+	clampToF1000(position);
+
 	if (m_player && position != m_base_position)
 		m_player->setDirty(true);
 
@@ -344,7 +350,7 @@ void PlayerSAO::setPos(const v3f &pos)
 
 	setBasePosition(pos);
 	// Movement caused by this command is always valid
-	m_last_good_position = pos;
+	m_last_good_position = getBasePosition();
 	m_move_pool.empty();
 	m_time_from_last_teleport = 0.0;
 	m_env->getGameDef()->SendMovePlayer(m_peer_id);
@@ -357,7 +363,7 @@ void PlayerSAO::moveTo(v3f pos, bool continuous)
 
 	setBasePosition(pos);
 	// Movement caused by this command is always valid
-	m_last_good_position = pos;
+	m_last_good_position = getBasePosition();
 	m_move_pool.empty();
 	m_time_from_last_teleport = 0.0;
 	m_env->getGameDef()->SendMovePlayer(m_peer_id);
diff --git a/src/server/player_sao.h b/src/server/player_sao.h
index 1067801e7..b84bf1e82 100644
--- a/src/server/player_sao.h
+++ b/src/server/player_sao.h
@@ -87,7 +87,7 @@ public:
 	std::string getClientInitializationData(u16 protocol_version) override;
 	void getStaticData(std::string *result) const override;
 	void step(float dtime, bool send_recommended) override;
-	void setBasePosition(const v3f &position);
+	void setBasePosition(v3f position);
 	void setPos(const v3f &pos) override;
 	void moveTo(v3f pos, bool continuous) override;
 	void setPlayerYaw(const float yaw);