SoniEx2
/
c.sexchat
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Fix out of bounds read when DCC message sender contains quotes 

This cannot be triggered by any user generally.

Fixes #2128
This commit is contained in:
Patrick Griffis 2018-03-04 12:14:09 -05:00
parent 6e4fc09ce0
commit f6333b592b
1 changed files with 23 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
src/common/proto-irc.c
View File

@ -1241,15 +1241,36 @@ process_named_msg (session *sess, char *type, char *word[], char *word_eol[],
len = strlen (text);
if (text[0] == 1 && text[len - 1] == 1) /* ctcp */
{
char *new_pdibuf = NULL;
text[len - 1] = 0;
text++;
if (g_ascii_strncasecmp (text, "ACTION", 6) != 0)
flood_check (nick, ip, serv, sess, 0);
if (g_ascii_strncasecmp (text, "DCC ", 4) == 0)
/* redo this with handle_quotes TRUE */
process_data_init (word[1], word_eol[1], word, word_eol, TRUE, FALSE);
{
int i;
char *new_word[PDIWORDS+1] = { NULL };
char *new_word_eol[PDIWORDS+1] = { NULL };
new_pdibuf = g_malloc (strlen (word_eol[6]) + 1);
/* This is a bit ugly but we handle the contents of the DCC message containing
* "quoted paths for files" here which means reparsing the message with handle_quotes.
* We avoid reparsing the entire message to avoid corrupting the non DCC parts.
* Greater than PDIWORD length DCC messages will be truncated. */
process_data_init (new_pdibuf, word_eol[6], new_word, new_word_eol, TRUE, FALSE);
for (i = 6; i < PDIWORDS; ++i)
{
word[i] = new_word[i - 5];
word_eol[i] = new_word_eol[i - 5];
}
}
ctcp_handle (sess, to, nick, ip, text, word, word_eol, id,
tags_data);
/* Note word will be invalid beyond this scope */
g_free (new_pdibuf);
} else
{
if (is_channel (serv, to))