SPIGOT-705: Fix possible CME

2 files changed, 33 insertions, 19 deletions

diff --git a/nms-patches/Chunk.patch b/nms-patches/Chunk.patch
index 720b6155..e78d136c 100644
--- a/nms-patches/Chunk.patch
+++ b/nms-patches/Chunk.patch
@@ -1,5 +1,5 @@
---- /home/matt/mc-dev-private//net/minecraft/server/Chunk.java	2015-02-26 22:40:22.311608142 +0000
-+++ src/main/java/net/minecraft/server/Chunk.java	2015-02-26 22:40:22.315608142 +0000
+--- /home/matt/mc-dev-private//net/minecraft/server/Chunk.java	2015-03-15 21:30:40.204367362 +0000
++++ src/main/java/net/minecraft/server/Chunk.java	2015-03-15 21:30:40.216367361 +0000
 @@ -14,6 +14,9 @@
  import org.apache.logging.log4j.LogManager;
  import org.apache.logging.log4j.Logger;
@@ -63,7 +63,15 @@
      public Chunk(World world, int i, int j) {
          this.sections = new ChunkSection[16];
          this.e = new byte[256];
-@@ -60,8 +91,17 @@
+@@ -54,14 +85,25 @@
+         this.locZ = j;
+         this.heightMap = new int[256];
+ 
++        /* CraftBukkit start
+         for (int k = 0; k < this.entitySlices.length; ++k) {
+             this.entitySlices[k] = new EntitySlice(Entity.class);
+         }
++        // CraftBukkit end */
  
          Arrays.fill(this.f, -999);
          Arrays.fill(this.e, (byte) -1);
@@ -81,7 +89,7 @@
      public Chunk(World world, ChunkSnapshot chunksnapshot, int i, int j) {
          this(world, i, j);
          short short0 = 256;
-@@ -529,7 +569,8 @@
+@@ -529,7 +571,8 @@
                      }
                  }
  
@@ -91,7 +99,7 @@
                      block.onPlace(this.world, blockposition, iblockdata);
                  }
  
-@@ -610,7 +651,11 @@
+@@ -610,7 +653,11 @@
          int j = MathHelper.floor(entity.locZ / 16.0D);
  
          if (i != this.locX || j != this.locZ) {
@@ -104,7 +112,7 @@
              entity.die();
          }
  
-@@ -697,6 +742,13 @@
+@@ -697,6 +744,13 @@
  
              tileentity.D();
              this.tileEntities.put(blockposition, tileentity);
@@ -118,7 +126,7 @@
          }
      }
  
-@@ -740,7 +792,21 @@
+@@ -740,7 +794,21 @@
          }
  
          for (int i = 0; i < this.entitySlices.length; ++i) {
@@ -141,7 +149,7 @@
          }
  
      }
-@@ -798,8 +864,8 @@
+@@ -798,8 +866,8 @@
              while (iterator.hasNext()) {
                  Entity entity = (Entity) iterator.next();
  
diff --git a/nms-patches/ChunkProviderServer.patch b/nms-patches/ChunkProviderServer.patch
index 23b20f81..c7d01ea3 100644
--- a/nms-patches/ChunkProviderServer.patch
+++ b/nms-patches/ChunkProviderServer.patch
@@ -1,5 +1,5 @@
---- /home/matt/mc-dev-private//net/minecraft/server/ChunkProviderServer.java	2015-02-26 22:40:22.319608142 +0000
-+++ src/main/java/net/minecraft/server/ChunkProviderServer.java	2015-02-26 22:40:22.323608142 +0000
+--- /home/matt/mc-dev-private//net/minecraft/server/ChunkProviderServer.java	2015-03-15 21:37:46.552362734 +0000
++++ src/main/java/net/minecraft/server/ChunkProviderServer.java	2015-03-15 21:37:46.552362734 +0000
 @@ -11,17 +11,28 @@
  import org.apache.logging.log4j.LogManager;
  import org.apache.logging.log4j.Logger;
@@ -138,7 +138,7 @@
  
          if (chunk == null) {
              chunk = this.loadChunk(i, j);
-@@ -79,16 +144,43 @@
+@@ -79,16 +144,49 @@
                          CrashReportSystemDetails crashreportsystemdetails = crashreport.a("Chunk to be generated");
  
                          crashreportsystemdetails.a("Location", (Object) String.format("%d,%d", new Object[] { Integer.valueOf(i), Integer.valueOf(j)}));
@@ -154,6 +154,12 @@
 -            this.chunks.put(k, chunk);
 -            this.chunkList.add(chunk);
 +            this.chunks.put(LongHash.toLong(i, j), chunk);
++            
++            // CraftBukkit start - moved from Chunk.<init>
++            for (int k = 0; k < chunk.entitySlices.length; ++k) {
++                chunk.entitySlices[k] = new EntitySlice(Entity.class);
++            }
++            // CraftBukkit end
              chunk.addEntities();
 +            
 +            // CraftBukkit start
@@ -185,7 +191,7 @@
              chunk.loadNearby(this, this, i, j);
          }
  
-@@ -96,12 +188,25 @@
+@@ -96,12 +194,25 @@
      }
  
      public Chunk getOrCreateChunk(int i, int j) {
@@ -214,7 +220,7 @@
          if (this.chunkLoader == null) {
              return null;
          } else {
-@@ -123,7 +228,7 @@
+@@ -123,7 +234,7 @@
          }
      }
  
@@ -223,7 +229,7 @@
          if (this.chunkLoader != null) {
              try {
                  this.chunkLoader.b(this.world, chunk);
-@@ -134,7 +239,7 @@
+@@ -134,7 +245,7 @@
          }
      }
  
@@ -232,7 +238,7 @@
          if (this.chunkLoader != null) {
              try {
                  chunk.setLastSaved(this.world.getTime());
-@@ -155,6 +260,30 @@
+@@ -155,6 +266,30 @@
              chunk.n();
              if (this.chunkProvider != null) {
                  this.chunkProvider.getChunkAt(ichunkprovider, i, j);
@@ -263,7 +269,7 @@
                  chunk.e();
              }
          }
-@@ -174,10 +303,12 @@
+@@ -174,10 +309,12 @@
  
      public boolean saveChunks(boolean flag, IProgressUpdate iprogressupdate) {
          int i = 0;
@@ -279,7 +285,7 @@
  
              if (flag) {
                  this.saveChunkNOP(chunk);
-@@ -205,22 +336,43 @@
+@@ -205,22 +342,43 @@
  
      public boolean unloadChunks() {
          if (!this.world.savingDisabled) {
@@ -330,7 +336,7 @@
  
              if (this.chunkLoader != null) {
                  this.chunkLoader.a();
-@@ -235,7 +387,8 @@
+@@ -235,7 +393,8 @@
      }
  
      public String getName() {
@@ -340,7 +346,7 @@
      }
  
      public List<BiomeBase.BiomeMeta> getMobsFor(EnumCreatureType enumcreaturetype, BlockPosition blockposition) {
-@@ -247,7 +400,8 @@
+@@ -247,7 +406,8 @@
      }
  
      public int getLoadedChunks() {