Merge branch 'coverity' of gitolite:eggdrop into coverity

Conflicts:
	src/mod/channels.mod/channels.c
	src/tcl.c

src/botcmd.c

@@ -929,7 +929,7 @@ static void bot_thisbot(int idx, char *par)
   noshare = 1;
   change_handle(dcc[idx].user, par);
   noshare = 0;
-  strncpyz(dcc[idx].nick, par, sizeof(dcc[idx].nick));
+  strncpyz(dcc[idx].nick, par, sizeof dcc[idx].nick);
 }
 
 static void bot_handshake(int idx, char *par)

src/botnet.c

@@ -1079,8 +1079,10 @@ static void botlink_resolve_success(int i)
   nfree(linker);
   setsnport(dcc[i].sockname, dcc[i].port);
   dcc[i].sock = getsock(dcc[i].sockname.family, SOCK_STRONGCONN);
+  if (dcc[i].sock < 0)
+    failed_link(i);
   ret = open_telnet_raw(dcc[i].sock, &dcc[i].sockname);
-  if (dcc[i].sock < 0 || ret < 0)
+  if (ret < 0)
     failed_link(i);
 #ifdef TLS
   else if (dcc[i].ssl && ssl_handshake(dcc[i].sock, TLS_CONNECT,
@@ -1484,7 +1486,7 @@ static void dcc_relay(int idx, char *buf, int j)
         for (e = p + 2; *e != 'm' && *e; e++);
         strcpy((char *) p, (char *) (e + 1));
       } else if (*p == '\r')
-        strcpy((char *) p, (char *) (p + 1));
+        memmove(p, p + 1, strlen(p + 1) + 1);
     }
     if (!buf[0])
       dprintf(-dcc[idx].u.relay->sock, " \n");

src/chanprog.c

@@ -362,7 +362,12 @@ void tell_verbose_status(int idx)
           ((interp) && (Tcl_Eval(interp, "info patchlevel") == TCL_OK)) ?
           tcl_resultstring() : (Tcl_Eval(interp, "info tclversion") == TCL_OK) ?
           tcl_resultstring() : "*unknown*", MISC_TCLHVERSION,
-          TCL_PATCH_LEVEL ? TCL_PATCH_LEVEL : "*unknown*");
+#ifdef TCL_PATCH_LEVEL
+          TCL_PATCH_LEVEL
+#else
+          "*unknown*"
+#endif
+          );
 
   if (tcl_threaded())
     dprintf(idx, "Tcl is threaded.\n");

src/cmds.c

@@ -656,7 +656,7 @@ static void cmd_console(struct userrec *u, int idx, char *par)
     return;
   }
   get_user_flagrec(u, &fr, dcc[idx].u.chat->con_chan);
-  strcpy(s1, par);
+  strncpyz(s1, par, sizeof s1);
   nick = newsplit(&par);
   /* Don't remove '+' as someone couldn't have '+' in CHANMETA cause
    * he doesn't use IRCnet ++rtc.
@@ -1665,7 +1665,7 @@ static void cmd_chattr(struct userrec *u, int idx, char *par)
   }
   if (chan)
     putlog(LOG_CMDS, "*", "#%s# (%s) chattr %s %s",
-           dcc[idx].nick, chan ? chan->dname : "*", hand, chg ? chg : "");
+           dcc[idx].nick, chan->dname, hand, chg ? chg : "");
   else
     putlog(LOG_CMDS, "*", "#%s# chattr %s %s", dcc[idx].nick, hand,
            chg ? chg : "");

src/dcc.c

@@ -702,7 +702,7 @@ static void dcc_chat_pass(int idx, char *buf, int atr)
       if (dcc[idx].status & STAT_TELNET)
         tputs(dcc[idx].sock, TLN_IAC_C TLN_WONT_C TLN_ECHO_C "\n", 4);
       dcc[idx].user = get_user_by_handle(userlist, dcc[idx].u.chat->away);
-      strcpy(dcc[idx].nick, dcc[idx].u.chat->away);
+      strncpyz(dcc[idx].nick, dcc[idx].u.chat->away, sizeof dcc[idx].nick);
       nfree(dcc[idx].u.chat->away);
       nfree(dcc[idx].u.chat->su_nick);
       dcc[idx].u.chat->away = NULL;
@@ -1055,7 +1055,7 @@ static void dcc_chat(int idx, char *buf, int i)
           if (dcc[idx].u.chat->su_nick) {
             dcc[idx].user = get_user_by_handle(userlist,
                                                dcc[idx].u.chat->su_nick);
-            strncpyz(dcc[idx].nick, dcc[idx].u.chat->su_nick, sizeof(dcc[idx].nick));
+            strncpyz(dcc[idx].nick, dcc[idx].u.chat->su_nick, sizeof dcc[idx].nick);
             dcc[idx].type = &DCC_CHAT;
             dprintf(idx, "Returning to real nick %s!\n",
                     dcc[idx].u.chat->su_nick);

src/dccutil.c

@@ -566,7 +566,7 @@ int detect_dcc_flood(time_t *timer, struct chat_info *chat, int idx)
 {
   time_t t;
 
-  if (!dcc_flood_thr)
+  if (!dcc_flood_thr || !chat)
     return 0;
   t = now;
   if (*timer != t) {
@@ -578,7 +578,7 @@ int detect_dcc_flood(time_t *timer, struct chat_info *chat, int idx)
       /* FLOOD */
       dprintf(idx, "*** FLOOD: %s.\n", IRC_GOODBYE);
       /* Evil assumption here that flags&DCT_CHAT implies chat type */
-      if ((dcc[idx].type->flags & DCT_CHAT) && chat && (chat->channel >= 0)) {
+      if ((dcc[idx].type->flags & DCT_CHAT) && (chat->channel >= 0)) {
         char x[1024];
 
         egg_snprintf(x, sizeof x, DCC_FLOODBOOT, dcc[idx].nick);

src/flags.c

@@ -513,7 +513,7 @@ int build_flags(char *string, struct flag_record *plus,
     string += flag2str(string, plus->chan, plus->udef_chan);
     if (minus && (minus->chan || minus->udef_chan)) {
       *string++ = '-';
-      string += flag2str(string, minus->global, minus->udef_chan);
+      string += flag2str(string, minus->chan, minus->udef_chan);
     }
   }
   if (string == old) {

src/language.c

@@ -148,8 +148,7 @@ static int del_lang(char *lang)
         lpo->next = lp->next;
       else
         langpriority = lp->next;
-      if (lp->lang)
-        nfree(lp->lang);
+      nfree(lp->lang);
       nfree(lp);
       debug1("LANG: Language unloaded: %s", lang);
       return 1;

src/main.c

@@ -265,8 +265,8 @@ static void write_debug()
      *       _not_ safe <cybah>
      */
     x = creat("DEBUG.DEBUG", 0644);
-    setsock(x, SOCK_NONSOCK);
     if (x >= 0) {
+      setsock(x, SOCK_NONSOCK);
       strncpyz(s, ctime(&now), sizeof s);
       dprintf(-x, "Debug (%s) written %s\n", ver, s);
       dprintf(-x, "Please report problem to bugs@eggheads.org\n");
@@ -310,8 +310,13 @@ static void write_debug()
     dprintf(-x, "Tcl version: %s (header version %s)\n",
             ((interp) && (Tcl_Eval(interp, "info patchlevel") == TCL_OK)) ?
             tcl_resultstring() : (Tcl_Eval(interp, "info tclversion") == TCL_OK) ?
-            tcl_resultstring() : "*unknown*", TCL_PATCH_LEVEL ? TCL_PATCH_LEVEL :
-            "*unknown*");
+            tcl_resultstring() : "*unknown*",
+#ifdef TCL_PATCH_LEVEL
+            TCL_PATCH_LEVEL
+#else
+            "*unknown*"
+#endif
+           );
 
     if (tcl_threaded())
       dprintf(-x, "Tcl is threaded\n");
@@ -899,7 +904,7 @@ int mainloop(int toplevel)
             d = d->next;
           }
           if (ok) {
-            strcpy(name, p->name);
+            strncpyz(name, p->name, sizeof name);
             if (module_unload(name, botnetnick) == NULL) {
               f = 1;
               break;
@@ -1083,7 +1088,7 @@ int main(int arg_c, char **arg_v)
   link_statics();
 #endif
   strncpyz(s, ctime(&now), sizeof s);
-  strcpy(&s[11], &s[20]);
+  memmove(&s[11], &s[20], strlen(&s[20]+1));
   putlog(LOG_ALL, "*", "--- Loading %s (%s)", ver, s);
   chanprog();
   if (!encrypt_pass) {
@@ -1163,6 +1168,9 @@ int main(int arg_c, char **arg_v)
   if (!backgrd && term_z) {
     int n = new_dcc(&DCC_CHAT, sizeof(struct chat_info));
 
+    if (!n)
+      fatal("ERROR: Failed to initialize foreground chat.", 0);
+
     getvhost(&dcc[n].sockname, AF_INET);
     dcc[n].sock = STDOUT;
     dcc[n].timeval = now;

src/mem.c

@@ -375,7 +375,7 @@ void *n_realloc(void *ptr, int size, const char *file, int line)
   if (i == lastused) {
     putlog(LOG_MISC, "*", "*** ATTEMPTING TO REALLOC NON-MALLOC'D PTR: %s (%d)",
            file, line);
-    return NULL;
+    /* If we reach this, realloc returned a pointer anyway. So we use it. */
   }
   memused -= memtbl[i].size;
   memtbl[i].ptr = x;

src/misc.c

@@ -640,7 +640,7 @@ void logsuffix_change(char *s)
   char *s2 = logfile_suffix;
 
   /* If the suffix didn't really change, ignore. It's probably a rehash. */
-  if (s && s2 && !strcmp(s, s2))
+  if (!s || (s && s2 && !strcmp(s, s2)))
     return;
 
   debug0("Logfile suffix changed. Closing all open logs.");

src/misc_file.c

@@ -49,8 +49,10 @@ int copyfile(char *oldpath, char *newpath)
   if (fi < 0)
     return 1;
   fstat(fi, &st);
-  if (!(st.st_mode & S_IFREG))
+  if (!(st.st_mode & S_IFREG)) {
+    close(fi);
     return 3;
+  }
   fo = creat(newpath, (int) (st.st_mode & 0777));
   if (fo < 0) {
     close(fi);

src/mod/channels.mod/channels.c

@@ -151,7 +151,7 @@ static void set_mode_protect(struct chanset_t *chan, char *set)
       if (pos) {
         s1 = newsplit(&set);
         if (s1[0])
-          strncpy(chan->key_prot, s1, sizeof(chan->key_prot));
+          strncpyz(chan->key_prot, s1, sizeof chan->key_prot);
       }
       break;
     }

src/mod/channels.mod/userchan.c

@@ -498,7 +498,7 @@ static int u_addinvite(struct chanset_t *chan, char *invite, char *from,
   else if (strchr(host, '!') == NULL) {
     char *i = strchr(host, '@');
 
-    strcpy(s, i);
+    strncpyz(s, i, sizeof s);
     *i = 0;
     strcat(host, "!*");
     strcat(host, s);

src/mod/console.mod/console.c

@@ -248,7 +248,7 @@ static int console_chon(char *handle, int idx)
   if (dcc[idx].type == &DCC_CHAT) {
     if (i) {
       if (i->channel && i->channel[0])
-        strcpy(dcc[idx].u.chat->con_chan, i->channel);
+        strncpyz(dcc[idx].u.chat->con_chan, i->channel, sizeof dcc[idx].u.chat->con_chan);
       get_user_flagrec(dcc[idx].user, &fr, i->channel);
       dcc[idx].u.chat->con_flags = check_conflags(&fr, i->conflags);
       dcc[idx].u.chat->strip_flags = i->stripflags;

src/mod/filesys.mod/filesys.c

@@ -707,7 +707,7 @@ static void filesys_dcc_send(char *nick, char *from, struct userrec *u,
       dcc[i].ssl = ssl;
 #endif
       dcc[i].user = u;
-      strcpy(dcc[i].nick, nick);
+      strncpyz(dcc[i].nick, nick, sizeof dcc[i].nick);
       strcpy(dcc[i].host, from);
       dcc[i].u.dns->cbuf = get_data_ptr(strlen(param) + 1);
       strcpy(dcc[i].u.dns->cbuf, param);

src/mod/irc.mod/chan.c

@@ -279,7 +279,7 @@ static int detect_chan_flood(char *floodnick, char *floodhost, char *from,
     if (!rfc_casecmp(chan->deopd, victim))
       return 0;
     else
-      strcpy(chan->deopd, victim);
+      strncpyz(chan->deopd, victim, sizeof chan->deopd);
   }
   chan->floodnum[which]++;
   if (chan->floodnum[which] >= thr) {   /* FLOOD */

src/mod/irc.mod/irc.c

@@ -850,7 +850,7 @@ static int check_tcl_pub(char *nick, char *from, char *chname, char *msg)
   char buf[512], *args = buf, *cmd, host[161], *hand;
   struct userrec *u;
 
-  strcpy(args, msg);
+  strncpyz(args, msg, sizeof msg);
   cmd = newsplit(&args);
   simple_sprintf(host, "%s!%s", nick, from);
   u = get_user_by_host(host);

src/mod/irc.mod/msgcmds.c

@@ -111,7 +111,7 @@ static int msg_hello(char *nick, char *h, struct userrec *u, char *p)
       if (p1 == NULL)
         s1[0] = 0;
       else
-        strcpy(s1, p1);
+        strncpyz(s1, p1, sizeof s1);
     }
   }
   return 1;
@@ -171,7 +171,7 @@ static int msg_ident(char *nick, char *host, struct userrec *u, char *par)
   }
   pass = newsplit(&par);
   if (!par[0])
-    strcpy(who, nick);
+    strncpyz(who, nick, sizeof who);
   else {
     strncpy(who, par, NICKMAX);
     who[NICKMAX] = 0;

src/mod/notes.mod/notes.c

@@ -222,7 +222,7 @@ static int tcl_storenote STDVAR
     int ok = 1;
 
     /* User is valid & has a valid forwarding address */
-     strcpy(fwd, f1); /* Only 40 bytes are stored in the userfile */
+     strncpyz(fwd, f1, sizeof fwd); /* Only 40 bytes are stored in the userfile */
      p = strchr(fwd, '@');
     if (p && !egg_strcasecmp(p + 1, botnetnick)) {
       *p = 0;

src/mod/seen.mod/seen.c

@@ -295,7 +295,7 @@ static void do_seen(int idx, char *prefix, char *nick, char *hand,
     /* "your admin" */
     if (!egg_strcasecmp(word1, "owner") || !egg_strcasecmp(word1, "admin")) {
       if (admin[0]) {
-        strncpyz(word2, admin, sizeof(word2));
+        strncpyz(word2, admin, sizeof word2);
         wordshift(whotarget, word2);
         strcat(whoredirect, "My owner is ");
         strcat(whoredirect, whotarget);

src/mod/server.mod/server.c

@@ -1509,7 +1509,7 @@ static int ctcp_DCC_CHAT(char *nick, char *from, char *handle,
   struct userrec *u = get_user_by_handle(userlist, handle);
   struct flag_record fr = { FR_GLOBAL | FR_CHAN | FR_ANYWH, 0, 0, 0, 0, 0 };
 
-  strcpy(msg, text);
+  strncpyz(msg, text, sizeof msg);
   action = newsplit(&msg);
   param = newsplit(&msg);
   ip = newsplit(&msg);
@@ -1673,7 +1673,7 @@ static void server_5minutely()
 
 static void server_prerehash()
 {
-  strcpy(oldnick, botname);
+  strncpyz(oldnick, botname, NICKLEN);
 }
 
 static void server_postrehash()

src/mod/server.mod/servmsg.c

@@ -122,7 +122,7 @@ static int check_tcl_msgm(char *cmd, char *nick, char *uhost,
   if (arg[0])
     simple_sprintf(args, "%s %s", cmd, arg);
   else
-    strcpy(args, cmd);
+    strncpyz(args, cmd, sizeof args);
   get_user_flagrec(u, &fr, NULL);
   Tcl_SetVar(interp, "_msgm1", nick, 0);
   Tcl_SetVar(interp, "_msgm2", uhost, 0);
@@ -442,7 +442,7 @@ static int detect_flood(char *floodnick, char *floodhost, char *from, int which)
   if (p) {
     p++;
     if (egg_strcasecmp(lastmsghost[which], p)) {        /* New */
-      strcpy(lastmsghost[which], p);
+      strncpyz(lastmsghost[which], p, sizeof lastmsghost[which]);
       lastmsgtime[which] = now;
       lastmsgs[which] = 0;
       return 0;
@@ -1284,7 +1284,7 @@ static void server_resolve_success(int servidx)
   char pass[121];
 
   resolvserv = 0;
-  strcpy(pass, dcc[servidx].u.dns->cbuf);
+  strncpyz(pass, dcc[servidx].u.dns->cbuf, sizeof pass);
   changeover_dcc(servidx, &SERVER_SOCKET, 0);
   dcc[servidx].sock = getsock(dcc[servidx].sockname.family, 0);
   setsnport(dcc[servidx].sockname, dcc[servidx].port);

src/mod/share.mod/share.c

@@ -1403,7 +1403,7 @@ static void new_tbuf(char *bot)
   tandbuf **old = &tbuf, *new;
 
   new = nmalloc(sizeof(tandbuf));
-  strcpy(new->bot, bot);
+  strncpyz(new->bot, bot, NICKLEN);
   new->q = NULL;
   new->timer = now;
   new->next = *old;

src/mod/transfer.mod/transfer.c

@@ -1088,7 +1088,7 @@ static int ctcp_DCC_RESUME(char *nick, char *from, char *handle,
   int i, port;
   unsigned long offset;
 
-  strcpy(msg, text);
+  strncpyz(msg, text, sizeof msg);
   action = newsplit(&msg);
 
   if (egg_strcasecmp(action, "RESUME"))

src/mod/transfer.mod/transferqueue.c

@@ -37,10 +37,10 @@ static void queue_file(char *dir, char *file, char *from, char *to)
   fileq->next = q;
   fileq->dir = nmalloc(strlen(dir) + 1);
   fileq->file = nmalloc(strlen(file) + 1);
-  strcpy(fileq->dir, dir);
-  strcpy(fileq->file, file);
-  strcpy(fileq->nick, from);
-  strcpy(fileq->to, to);
+  strncpyz(fileq->dir, dir, sizeof fileq->dir);
+  strncpyz(fileq->file, file, sizeof fileq->file);
+  strncpyz(fileq->nick, from, sizeof fileq->nick);
+  strncpyz(fileq->to, to, sizeof fileq->to);
 }
 
 static void deq_this(fileq_t *this)

src/net.c

@@ -468,7 +468,7 @@ static int proxy_connect(int sock, sockname_t *addr)
 #endif
   if (firewall[0] == '!') {
     proxy = PROXY_SUN;
-    strncpyz(host, &firewall[1], sizeof(host));
+    strncpyz(host, &firewall[1], sizeof host);
   } else {
     proxy = PROXY_SOCKS;
     strcpy(host, firewall);
@@ -990,7 +990,8 @@ int sockgets(char *s, int *len)
           if (strlen(socklist[i].handler.sock.inbuf) > 510)
             socklist[i].handler.sock.inbuf[510] = 0;
           strcpy(s, socklist[i].handler.sock.inbuf);
-          px = nmalloc(strlen(p + 1) + 1);
+          /* intentional, we strip the first character. */
+          px = nmalloc(strlen(p));
           strcpy(px, p + 1);
           nfree(socklist[i].handler.sock.inbuf);
           if (px[0])
@@ -1421,9 +1422,10 @@ int sanitycheck_dcc(char *nick, char *from, char *ipaddy, char *port)
              "address of %s!", nick, from, ipaddy);
       return 0;
     }
-    if (IN6_IS_ADDR_V4MAPPED(&name.addr.s6.sin6_addr))
+    if (IN6_IS_ADDR_V4MAPPED(&name.addr.s6.sin6_addr)) {
       egg_memcpy(&ip, name.addr.s6.sin6_addr.s6_addr + 12, sizeof ip);
       ip = ntohl(ip);
+    }
   }
 #endif
   if (ip && inet_ntop(AF_INET, &ip, badaddress, sizeof badaddress) &&