Pocketmine-mp: /give allows meta values >32767 even though these cannot be saved

[Muqsit]

Issue description

Since ShortTags have a(n unsigned max) value of 65535, anyone giving themselves something such as a paper with damage 65535 would cause the server to crash on Player::save(). Giving yourself an item with damage > 65535 isn't possible as PocketMine automatically changes the value to 0. But you can give yourself an item with damage 65535 and it will stop raklib.

Anyone with operator permissions or pocketmine.command.give would technically have the freedom to halt the server.

Steps to reproduce the issue

1. /give yourself paper:65535
2. Quit the server

OS and versions

• PocketMine-MP: eb05f2e
• PHP: 7.0.19
• Server OS: Ubuntu 14.04 LTS
• Game version: Win10 (irrelevant)

Plugins

• Is the issue reproducible without any plugins loaded?
  Yes

Crashdump, backtrace or other files

• https://prnt.sc/fkg9p3

[dktapps]

This should be capped to signed-short max (32767) as per MCPE.

[Muqsit]

Yeah, much better!

[dktapps]

There is also a degree of undefinedness around the any-damage meta value. PocketMine currently considers it to be -1, but MCPE uses 32767 (signed-short max) (they don't allow negatives anymore since 1.1). I haven't decided how best to resolve this yet.

[Muqsit]

@dktapps Does that apply to tools too?

[dktapps]

It applies to all items. You're bounded to 0-32766 for valid non-special meta values now.