Your code is far too trusting.

For example, looking at the code, it looks like if I send something that purports to be a string, but is not null terminated, you are going to simply cast and go, resulting in either a read of random garbage, or, more likely, an access violation.

Similarly, and again, just on a read through, I can cause the server to allocate large blocks of memory and then (most likely) crash by sending a malformed vector.

Yes, proper checking will be added in one of the next versions to verify packets.

Update: Hack-Safety added. Also a small code portion to try "hacking" itself is included in the benchmark sample; you are free to try it.

If you manage to get it crashing by sending a malformed packet, let me know.

// Example code to send a random packet to try "hacking" the remote
net::Message m;
net::Any a(0); a.net_push(m); // function 0
net::Any b(3); b.net_push(m); // 3 parameters
loopi(0, 100) m.push_back((t_now * 23423423 + i * 34553 + t + 423423)%40);
server.send_to(clientid, m);

Yes, proper checking will be added in one of the next versions to verify packets.

It is, unfortunately, the case that the Internet is a dangerous place. If you don't actually have experience writing network-secure code, then perhaps you should put that information top and center in your library description, to avoid the unfortunate effects that would come from someone else relying on the code when it can't actually be relied upon.

Yes, network is indeed a dangerous place.

The good thing is, that since the lib is open source, developers can notify me in case they find an issue.

This is why I asked to test the lib and try to get it crashing from sending packets.

The more it is tested for safety, the better it gets.

I believe the greatest threat will be gamers trying to cheat, so man in the middle attacks might be rare.

You have a lot of signed/unsigned comparisons going on in that code, what warning level are you compiling with?

ok, fixed. Was mostly int / size_t warnings. I know this will limit the lib to send only packets < 2GB, but thats still far too large. To make the server respond fast, packet size must be limited in the next version to a user defined value. Packets greater than that will be discarded.