Merge branch 'master' into tcg_random

ygopro-server.coffee

@@ -3231,6 +3231,9 @@ ygopro.ctos_follow 'UPDATE_DECK', true, (buffer, info, client, server, datas)->
   room=ROOM_all[client.rid]
   return false unless room
   #log.info info
+  if info.mainc > 256 or info.sidec > 256 # Prevent attack, see https://github.com/Fluorohydride/ygopro/issues/2174
+    CLIENT_kick(client)
+    return true
   buff_main = (info.deckbuf[i] for i in [0...info.mainc])
   buff_side = (info.deckbuf[i] for i in [info.mainc...info.mainc + info.sidec])
   client.main = buff_main

ygopro-server.js

@@ -4124,6 +4124,10 @@
     if (!room) {
       return false;
     }
+    if (info.mainc > 256 || info.sidec > 256) {
+      CLIENT_kick(client);
+      return true;
+    }
     buff_main = (function() {
       var m, ref3, results;
       results = [];