1 files changed, 26 insertions, 0 deletions
diff --git a/patches/server/0352-Validate-PickItem-Packet-and-kick-for-invalid.patch b/patches/server/0352-Validate-PickItem-Packet-and-kick-for-invalid.patch
new file mode 100644
index 0000000000..41621adc9a
--- /dev/null
+++ b/patches/server/0352-Validate-PickItem-Packet-and-kick-for-invalid.patch
@@ -0,0 +1,26 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Aikar <[email protected]>
+Date: Sat, 2 May 2020 03:09:46 -0400
+Subject: [PATCH] Validate PickItem Packet and kick for invalid
+
+
+diff --git a/src/main/java/net/minecraft/server/network/ServerGamePacketListenerImpl.java b/src/main/java/net/minecraft/server/network/ServerGamePacketListenerImpl.java
+index 0d6cdd7e52bffe392a668a0885855b9ca7cb4368..ca4dd5aa34188e121eb92d58305a2979b3797a12 100644
+--- a/src/main/java/net/minecraft/server/network/ServerGamePacketListenerImpl.java
++++ b/src/main/java/net/minecraft/server/network/ServerGamePacketListenerImpl.java
+@@ -895,7 +895,14 @@ public class ServerGamePacketListenerImpl extends ServerCommonPacketListenerImpl
+     @Override
+     public void handlePickItem(ServerboundPickItemPacket packet) {
+         PacketUtils.ensureRunningOnSameThread(packet, this, this.player.serverLevel());
+-        this.player.getInventory().pickSlot(packet.getSlot());
++        // Paper start - validate pick item position
++        if (!(packet.getSlot() >= 0 && packet.getSlot() < this.player.getInventory().items.size())) {
++            ServerGamePacketListenerImpl.LOGGER.warn("{} tried to set an invalid carried item", this.player.getName().getString());
++            this.disconnect(Component.literal("Invalid hotbar selection (Hacking?)"));
++            return;
++        }
++        this.player.getInventory().pickSlot(packet.getSlot()); // Paper - Diff above if changed
++        // Paper end - validate pick item position
+         this.player.connection.send(new ClientboundContainerSetSlotPacket(-2, 0, this.player.getInventory().selected, this.player.getInventory().getItem(this.player.getInventory().selected)));
+         this.player.connection.send(new ClientboundContainerSetSlotPacket(-2, 0, packet.getSlot(), this.player.getInventory().getItem(packet.getSlot())));
+         this.player.connection.send(new ClientboundSetCarriedItemPacket(this.player.getInventory().selected));