# Malformed .BMP file in Counter-Strike 1.6 may cause shellcode injection

Malformed overview BMP sent by a CS 1.6 server overflows the stack in LoadBMP8, letting the server run shellcode on connecting clients.

- Payout: hidden
- Severity: high
- Program: Valve
- Found by: kohtep2010
- Disclosed: 2020-02-27
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/397545
- Library page: https://bugbountylibrary.com/r/h1%3A397545
- Tags: area:os domain:desktop impact:rce kind:bounty platform:hackerone sev:high tech:windows technique:source-review vuln:memory-corruption vuln:rce

**Target:** GoldSource engine hl.exe LoadBMP8 overview BMP parser
**Root cause:** LoadBMP8 copies BMP data into a fixed stack buffer without bounds checking, so a malformed overviews\%MAPNAME%.bmp overflows the stack and overwrites the return address.
**Steps:**
1. Server loads a map name absent on the client, e.g. `definitely_missing_client_map.bsp`, prompting the client to download missing files.
2. Place a malformed `overviews\definitely_missing_client_map.bmp` plus matching `.txt` overview description on the server.
3. Client downloads bsp/bmp/txt, then loads the BMP via LoadBMP8 when viewing the map.
4. Crafted BMP overwrites the stack with shellcode that calls WinExec to launch `calc.exe`.
**How found:** Researcher examined the GoldSource engine's LoadBMP8 overview-loading path, noticed the fixed stack buffer, and built a BMP 'compiler' to craft an overflowing file with stack shellcode.
**Exploitation:** Attacker controls a game server; when a victim connects to a map whose files the client lacks, the client auto-downloads the malicious overview BMP and executes it on load, achieving remote code execution on the client.
**Insight:** Client auto-download of server-supplied map assets (overview BMPs) is an attack surface: any parser of downloaded resources runs pre-trust and is reachable by merely connecting to a malicious server.