Author: Kev <klmitch@mit.edu>

Log message:

Fix buffer overflow problem; tune lengths fed into ircd_vsnprintf() to take
into account the fact that ircd_vsnprintf() already takes \0 into account.

Testing:

The old hack code to test for this buffer overflow is still in place,
intentionally, to catch any other problems that may crop up.  Otherwise,
this code has been compiled and tested and produces the correct results--
never knew I could write a simple client that rapidly ;)

git-svn-id: file:///home/klmitch/undernet-ircu/undernet-ircu-svn/ircu2/trunk@381 c9e4aea6-c8fd-4c43-8297-357d70d61c8c

diff --git a/ChangeLog b/ChangeLog
index c710d33e8f0529d7eb437df79dc063b4e049dee3..88f5d324eaedd0a695fb6bf95e4af50a74c6c70f 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,11 @@
+2001-01-24  Kevin L. Mitchell  <klmitch@mit.edu>
+
+       * ircd/msgq.c: ircd_vsnprintf() returns the number of bytes that
+       it would have written; upper-bound the number to prevent overflows
+       by proxy; also, tune buffer size given to ircd_vsnprintf() to take
+       into account the fact that ircd_vsnprintf() already takes the
+       terminal \0 into account
+
 2001-01-22  Kevin L. Mitchell  <klmitch@mit.edu>
 
        * ircd/msgq.c: add an incredibly ugly hack to attempt to track

diff --git a/ircd/msgq.c b/ircd/msgq.c
index 7c03fd9785973a494ef90183dd51619c93f2a991..41ae2420dccbfe8a2e697413dfcdfefeb760c16d 100644 (file)
--- a/ircd/msgq.c
+++ b/ircd/msgq.c
@@ -282,7 +282,10 @@ msgq_vmake(struct Client *dest, const char *format, va_list vl)
   mb->ref = 1;
 
   /* fill the buffer */
-  mb->length = ircd_vsnprintf(dest, mb->msg, sizeof(mb->msg) - 3, format, vl);
+  mb->length = ircd_vsnprintf(dest, mb->msg, sizeof(mb->msg) - 2, format, vl);
+
+  if (mb->length > sizeof(mb->msg) - 3)
+    mb->length = sizeof(mb->msg) - 3;
 
   mb->msg[mb->length++] = '\r'; /* add \r\n to buffer */
   mb->msg[mb->length++] = '\n';
@@ -332,9 +335,12 @@ msgq_append(struct Client *dest, struct MsgBuf *mb, const char *format, ...)
 
   va_start(vl, format); /* append to the buffer */
   mb->length += ircd_vsnprintf(dest, mb->msg + mb->length,
-                              sizeof(mb->msg) - 3 - mb->length, format, vl);
+                              sizeof(mb->msg) - 2 - mb->length, format, vl);
   va_end(vl);
 
+  if (mb->length > sizeof(mb->msg) - 3)
+    mb->length = sizeof(mb->msg) - 3;
+
   mb->msg[mb->length++] = '\r'; /* add \r\n to buffer */
   mb->msg[mb->length++] = '\n';
   mb->msg[mb->length] = '\0'; /* not strictly necessary */