reject non-finite deflection in setControl

The CTRL channel routes straight into setControl, and that setter was the one
of the three without the guard setAlpha and setSpeed have carried since UDP
landed: math.Max/math.Min propagate a NaN instead of clamping it. A stray
"CTRL nan" from anywhere on the network left controlDeg permanently NaN, and
in a scene whose control surface is rotated by it, that surface leaves the
rasterized mask entirely.

Reproduced before fixing and pinned at both levels: the setter, and the wire
form through the real parse-and-drain path.

Also checks the rebind Close in the multicast supervisor, which the linter
flagged; the socket is being replaced either way, so the error has nowhere to
go but the blank identifier.

Author: crgimenes

control_test.go

@@ -0,0 +1,61 @@
+package main
+
+import (
+	"math"
+	"testing"
+)
+
+// TestSetControlRejectsNonFinite guards the third of the three setters every
+// input path shares. math.Max/math.Min propagate a NaN rather than clamping
+// it, and a NaN deflection rotates the control surface out of the rasterized
+// mask, so an unchecked "CTRL nan" over UDP would delete part of the body with
+// no way back. setAlpha and setSpeed have carried this guard since the UDP
+// channel landed; this one arrived with CTRL.
+func TestSetControlRejectsNonFinite(t *testing.T) {
+	g := simGame()
+	g.setScene(nekoScene(), "neko")
+	want := g.controlDeg
+
+	for _, bad := range []float64{math.NaN(), math.Inf(1), math.Inf(-1)} {
+		g.setControl(bad)
+		if g.controlDeg != want {
+			t.Fatalf("setControl(%v): controlDeg = %v, want unchanged %v", bad, g.controlDeg, want)
+		}
+	}
+
+	// The guard must not be over-broad: a valid deflection still applies, and
+	// an out-of-range one still clamps rather than being rejected.
+	g.setControl(12)
+	if g.controlDeg != 12 {
+		t.Errorf("setControl(12): controlDeg = %v, want 12", g.controlDeg)
+	}
+	g.setControl(9999)
+	if g.controlDeg != controlLimit {
+		t.Errorf("setControl(9999): controlDeg = %v, want clamped to %v", g.controlDeg, controlLimit)
+	}
+}
+
+// TestUDPControlChannelIsGuarded replays the wire form of the same attack, so
+// the guarantee is pinned at the protocol level and not just at the setter.
+func TestUDPControlChannelIsGuarded(t *testing.T) {
+	g := simGame()
+	g.setScene(nekoScene(), "neko")
+
+	for _, wire := range []string{"CTRL nan", "CTRL inf", "CTRL -inf", "CTRL 1e400"} {
+		g.applyControlMessage(wire)
+		g.drainPending()
+		if math.IsNaN(g.controlDeg) || math.IsInf(g.controlDeg, 0) {
+			t.Fatalf("%q: controlDeg went non-finite (%v)", wire, g.controlDeg)
+		}
+	}
+
+	solid := 0
+	for _, v := range g.sceneMask(0) {
+		if v {
+			solid++
+		}
+	}
+	if solid == 0 {
+		t.Error("the body vanished from the mask after hostile CTRL input")
+	}
+}

game.go

@@ -541,6 +541,14 @@ func (g *Game) controlObject() *scene.Object {
 // setControl changes the live control-surface deflection in place (no reset),
 // re-applying immediately so it moves even while the timeline is paused.
 func (g *Game) setControl(deg float64) {
+	// Reject non-finite input here, the way setAlpha and setSpeed already do:
+	// math.Max/math.Min propagate a NaN instead of clamping it, and a NaN
+	// deflection rotates the control surface out of the rasterized mask, so a
+	// stray "CTRL nan" over the network would delete part of the body with no
+	// UI path back. This is the choke point every caller shares.
+	if math.IsNaN(deg) || math.IsInf(deg, 0) {
+		return
+	}
 	g.controlDeg = math.Max(-controlLimit, math.Min(controlLimit, deg))
 	g.noteUserInput()
 	if g.scn == nil {

udpcontrol.go

@@ -68,7 +68,9 @@ func (g *Game) udpControlSupervisor(addr string, conn net.PacketConn) {
 			// The read loop only returns on a real socket error; rebinding
 			// below is also the recovery path for that, not just the timer.
 		case <-time.After(udpRebindInterval):
-			conn.Close()
+			// Closing is how the read loop is unblocked, so a close error has
+			// nowhere useful to go: the socket is being replaced regardless.
+			_ = conn.Close()
 			<-done
 		}