philippelh/bitchx
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix overflow in say() when handling a client message over the maximum.

Browse Source 
This was noticed when /channel on a very large channel segfaulted.


git-svn-id: svn://svn.code.sf.net/p/bitchx/code/trunk@528 13b04d17-f746-0410-82c6-800466cd88b0
This commit is contained in:
Kevin Easton
2014-11-05 09:32:46 +00:00
parent ca55063443
commit 93d06b03c9
2 changed files with 10 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
Changelog
View File

@@ -1,5 +1,7 @@
[Changes 1.2c01] [Changes 1.2c01]
* Fix overflow in say() when handling a maximum-length client message. (caf)
* Remove WANT_CHAN_NICK_SERV define and include network services commands * Remove WANT_CHAN_NICK_SERV define and include network services commands
by default. (caf) by default. (caf)

17
source/output.c
View File

@@ -194,22 +194,21 @@ void BX_put_it(const char *format, ...)
*/ */
void say (const char *format, ...) void say (const char *format, ...)
{ {
int len = 0;
if (window_display && format) if (window_display && format)
{ {
size_t len;
va_list args; va_list args;
snprintf(putbuf, LARGE_BIG_BUFFER_SIZE, "%s ", thing_ansi ? thing_ansi : three_stars);
len = strlen(putbuf);
va_start (args, format); va_start (args, format);
if (thing_ansi) vsnprintf(putbuf + len, LARGE_BIG_BUFFER_SIZE - len, format, args);
len = strlen(thing_ansi);
else
len = 3;
vsnprintf(&(putbuf[len+1]), LARGE_BIG_BUFFER_SIZE, format, args);
va_end(args); va_end(args);
strcpy(putbuf, thing_ansi?thing_ansi:three_stars);
putbuf[len] = ' ';
if (strip_ansi_in_echo) if (strip_ansi_in_echo)
{ {
register char *ptr; char *ptr;
for (ptr = putbuf + len; *ptr; ptr++) for (ptr = putbuf + len; *ptr; ptr++)
if (*ptr < 31 && *ptr > 13) if (*ptr < 31 && *ptr > 13)
if (*ptr != 15 && *ptr != 22) if (*ptr != 15 && *ptr != 22)