Fixed Pawn Shop: sell price above 2,147,483,647 overflows (wraps to a wrong price)

[licol2]

Hello,

I found a price overflow in the Pawn Shop service on r2083 (Classic 166 client, Interlude content).

Summary

The Pawn Shop sell price is handled as a 32-bit int, but the rest of the server handles adena as 64-bit. The default LimitItemsAmount is 256,000,000,000, and the sell price edit box accepts 12 digits (length="12" in mods/pawnshop/sell_price.htm and the Community Board version). A price above 2,147,483,647 is not rejected. It is truncated to 32 bits (value & 0xFFFFFFFF, then cast to int). The pawnshop.price column is also int(11).

Steps to reproduce

1. Open the Pawn Shop (NPC or Community Board) and choose an item to sell.
2. Enter a price of 5000000000 (5 billion) with adena as the currency and confirm.
3. Check the item in the buy list or in "My Items For Sale".

Result

• The item is listed for 705,032,704 (5,000,000,000 mod 2^32), with no warning. The seller loses most of the value.
• Prices between 2,147,483,648 and 4,294,967,295 become negative.

Expected

• Either support 64-bit prices, like the private store and mail (long in the code and BIGINT in the DB),
• or reject any price above Integer.MAX_VALUE with a message, instead of silently truncating it.

Suggested fix

• Parse the price as long and validate 0 < price <= limit before storing.
• Change pawnshop.price (and amount, if needed) to BIGINT.
• Optionally, limit the edit box length in the HTML to match the accepted maximum.

Could you take a look? Thanks!

 

[Deazer]

Hello,

I found a price overflow in the Pawn Shop service on r2083 (Classic 166 client, Interlude content).

Summary

The Pawn Shop sell price is handled as a 32-bit int, but the rest of the server handles adena as 64-bit. The default LimitItemsAmount is 256,000,000,000, and the sell price edit box accepts 12 digits (length="12" in mods/pawnshop/sell_price.htm and the Community Board version). A price above 2,147,483,647 is not rejected. It is truncated to 32 bits (value & 0xFFFFFFFF, then cast to int). The pawnshop.price column is also int(11).

Steps to reproduce

1. Open the Pawn Shop (NPC or Community Board) and choose an item to sell.
2. Enter a price of 5000000000 (5 billion) with adena as the currency and confirm.
3. Check the item in the buy list or in "My Items For Sale".

Result

• The item is listed for 705,032,704 (5,000,000,000 mod 2^32), with no warning. The seller loses most of the value.
• Prices between 2,147,483,648 and 4,294,967,295 become negative.

Expected

• Either support 64-bit prices, like the private store and mail (long in the code and BIGINT in the DB),
• or reject any price above Integer.MAX_VALUE with a message, instead of silently truncating it.

Suggested fix

• Parse the price as long and validate 0 < price <= limit before storing.
• Change pawnshop.price (and amount, if needed) to BIGINT.
• Optionally, limit the edit box length in the HTML to match the accepted maximum.

Could you take a look? Thanks!

done. There’s no need to use AI to generate a repor. I’m not an idiot. A brief description and reproduction steps are all I need - the more meaningless text you include, the harder it is for me to understand what you actually need. Take this part, for example: "The item is listed for 705,032,704 (5,000,000,000 mod 2^32), with no warning. The seller loses most of the value." You don't even seem to understand what's written there yourself - so why submit a report like that?
Keep it short and sweet