Changeset a2fadb4 in code

Timestamp:

Mar 7, 2014, 3:21:30 PM (11 years ago)

Author:

Mike Belopuhov <mike@…>

Branches:

master

Children:

8871953

Parents:

270fd23

git-author:

Mike Belopuhov <mike@…> (03/07/14 15:17:23)

git-committer:

Mike Belopuhov <mike@…> (03/07/14 15:21:30)

Message:

Get rid of ICB_MSGSIZE+1, fix various off-by-ones and do some truncation
where necessary.

Files:

• icb.c (modified) (4 diffs)
• icb.h (modified) (2 diffs)
• icbd.c (modified) (2 diffs)
• logger.c (modified) (1 diff)

icb.c

@@ -82 +82 @@
 
         is->last = getmonotime();
-        type = msg[1];
-        msg += 2;
+        type = msg[0];
+        msg++;
         if (!ISSETF(is->flags, ICB_SF_LOGGEDIN) && type != ICB_M_LOGIN) {
                 icb_error(is, "Not logged in");
@@ -378 +378 @@
     const char *fmt, ...)
 {
-        char buf[ICB_MSGSIZE];
+        char buf[ICB_MSGSIZE - 10]; /* truncate to make sure all fits */
         va_list ap;
         struct icb_session *s;
@@ -481 +481 @@
 icb_dowho(struct icb_session *is, struct icb_group *ig)
 {
-        char buf[ICB_MSGSIZE];
+        char buf[ICB_MSGSIZE - 10]; /* truncate to make sure all fits */
         struct icb_session *s;
         int nusers = 0;
@@ -510 +510 @@
 icb_who(struct icb_session *is, struct icb_group *ig)
 {
-        char buf[ICB_MSGSIZE];
+        char buf[ICB_MSGSIZE - 10]; /* truncate to make sure all fits */
         struct icb_group *g;
 

icb.h

@@ -18 +18 @@
 #include <sys/tree.h>
 
+/*
+ * ICB packet has the following format: <length><type><data>
+ * <lenght> is one byte length of the packet excluding the <lenght> byte;
+ * <type> is one byte type of the packet;
+ * <data> might not be null-terminated.
+ */
 #define ICB_MSGSIZE              256
 
@@ -71 +77 @@
         char                     client[ICB_MAXNICKLEN];
         char                     host[MAXHOSTNAMELEN];
-        char                     buffer[ICB_MSGSIZE+1];
+        char                     buffer[ICB_MSGSIZE];
         struct event             ev;
         struct bufferevent      *bev;

icbd.c

@@ -378 +378 @@
 {
         struct icb_session *is = (struct icb_session *)arg;
+        unsigned char length;
 
         while (EVBUFFER_LENGTH(EVBUFFER_INPUT(bev)) > 0) {
                 if (is->length == 0) {
                         /* read length */
-                        is->rlen = bufferevent_read(bev, is->buffer, 1);
-                        is->length = (size_t)(unsigned char)is->buffer[0];
-                        if (is->length == 0) {
+                        bufferevent_read(bev, &length, 1);
+                        if (length == 0) {
+                                /*
+                                 * An extension has been proposed:
+                                 * if length is 0, the packet is part of an
+                                 * "extended packet". The packet should be
+                                 * treated as if length was 255 and the next
+                                 * packet received from the sender should be
+                                 * appended to this packet.
+                                 *
+                                 * This server doesn't support this yet.
+                                 */
                                 icbd_drop(is, "invalid packet");
                                 return;
                         }
+                        is->length = (size_t)length;
+                        is->rlen = 0;
                 }
                 /* read as much as we can */
@@ -406 +418 @@
                 if (is->rlen < is->length)
                         return;
+                /* null-terminate the data */
+                is->buffer[MIN(is->rlen, ICB_MSGSIZE - 1)] = '\0';
                 /* process the message in full */
                 icb_input(is);

logger.c

@@ -197 +197 @@
                         return;
                 /* terminate the buffer */
-                m[MIN(nread - sizeof *e, ICB_MSGSIZE)] = '\0';
+                m[MIN(nread - sizeof *e, ICB_MSGSIZE - 1)] = '\0';
                 /* find the appropriate log file */
                 for (i = 0; i < nlogfiles; i++)