Skip to content

Commit

Permalink
Fix invalid memory access
Browse files Browse the repository at this point in the history
Found by: michaelortmann
Patch by: michaelortmann

Underrun for s[strlen(s) - 1]
  • Loading branch information
michaelortmann authored and vanosg committed Sep 16, 2018
1 parent a420ddb commit 9e66561
Showing 1 changed file with 11 additions and 11 deletions.
22 changes: 11 additions & 11 deletions src/net.c
Expand Up @@ -1104,19 +1104,19 @@ int sockgets(char *s, int *len)
}
}
/* Look for EOL marker; if it's there, i have something to show */
p = strchr(xx, '\n');
if (p == NULL)
p = strchr(xx, '\r');
if (p != NULL) {
*p = 0;
strcpy(s, xx);
memmove(xx, p + 1, strlen(p + 1) + 1);
if (s[strlen(s) - 1] == '\r')
s[strlen(s) - 1] = 0;
data = 1; /* DCC_CHAT may now need to process a blank line */
for (p = xx; *p != 0 ; p++) {
if ((*p == '\r') || (*p == '\n')) {
memcpy(s, xx, p - xx);
s[p - xx] = 0;
for (p++; (*p == '\r') || (*p == '\n'); p++);
memmove(xx, p, strlen(p) + 1);
data = 1; /* DCC_CHAT may now need to process a blank line */
break;
}
}
/* NO! */
/* if (!s[0]) strcpy(s," "); */
} else {
if (!data) {
s[0] = 0;
if (strlen(xx) >= 510) {
/* String is too long, so just insert fake \n */
Expand Down

0 comments on commit 9e66561

Please sign in to comment.