209409 2008-02-09 03:43 0000 games-server/monopd-0.9.3-r1 security patch is broke and off by one 2008-02-09 04:30:37 0000 1 1 1 Unclassified Gentoo Linux Games unspecified All Linux RESOLVED FIXED P2 normal --- 1 jouva@moufette.com games@gentoo.org jouva@moufette.com 2008-02-09 03:43:18 0000 The security patch for the commands to the server is incorrect. The first change (from data.substr(2) to data.substr(2,16)) is fine since that's where the proper data is. The new player function receives the FULL command (.nNickname). HOWEVER in the processCommands() function, the period is stripped (it's called with data+1). Therefore when CHANGING your nickname and calling it with data.substr(2,16) .nNickname sets one's nickname to "ickname". Likewise, the picture icon command is ALSO broken. The patch should be modified. Reproducible: Always mr_bones_@gentoo.org 2008-02-09 04:30:37 0000 yes, upstream changed the patch. Resync and re-emerge to get the fixed up patch.