# Malformed BSP in GoldSrc Engine may cause shellcode injection

Malformed BSP entity string overflows UTIL_StringToIntArray in GoldSrc mp.dll, letting a malicious map hijack the return address and run shellcode on clients.

- Payout: hidden
- Severity: high
- Program: Valve
- Found by: kohtep2010
- Disclosed: 2020-03-25
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/458929
- Library page: https://bugbountylibrary.com/r/h1%3A458929
- Tags: area:os domain:desktop impact:rce kind:bounty platform:hackerone sev:high tech:windows technique:chained technique:source-review vuln:memory-corruption vuln:rce

**Target:** hl.exe / GoldSrc server mod library (mp.dll/cs.so) parsing BSP entities
**Root cause:** UTIL_StringToIntArray copies the entity keyvalue string pString into a fixed buffer without a length check, so an oversized value in a BSP entity overflows the stack and overwrites the return address.
**Steps:**
1. Craft a BSP (e.g. 35hp_2) whose game_text entity keyvalue string is oversized and contains shellcode plus a return address pointing at it.
2. Place the malformed map in the mod's maps folder (e.g. Counter-Strike 1.6).
3. Run `map 35hp_2_shell` in console, or have a client connect to HLDS which sends the malformed map.
4. Server sends console command `map 35hp_2_shell` to the client (not on the stufftext filter list), starting a local server.
5. Local server loads the malformed map, triggering the overflow and shellcode execution (e.g. WinExec calc).
**How found:** Traced the entity-loading call chain SV_LoadEntities -> ED_LoadFromFile -> ED_ParseEdict -> pfnKeyValue -> CGameText::KeyValue -> UTIL_StringToIntArray and identified the unchecked strcpy-style copy of pString.
**Exploitation:** Attacker hosts a malicious BSP on an HLDS server; when a client connects and downloads it, the server issues a stufftext `map <name>` command that is not filtered, causing the client to start a local server, load the malformed map, and execute the embedded shellcode. Alternatively the map can be uploaded to a web resource to infect downloaders.
**Escalation:** Chains map download with an unfiltered stufftext `map` command to force client-side map load and code execution without user action.
**Insight:** Stufftext command filters are a separate attack surface from the engine parser: an unfiltered `map` command turns a client-side map-parsing overflow into remote code execution on connect, so audit which console commands survive the filter.