[NeoStats-Devel] [Commits] r2797 - in trunk: . include modules/connectserv src

Author: Fish
Date: Fri Sep  9 21:07:54 2005
New Revision: 2797

Modified:
   trunk/ChangeLog
   trunk/include/neostats.h
   trunk/modules/connectserv/cs.c
   trunk/src/misc.c
Log:
escape any % format specifiers we recieve from clients

Modified: trunk/ChangeLog
==============================================================================
--- trunk/ChangeLog	(original)
+++ trunk/ChangeLog	Fri Sep  9 21:07:54 2005
@@ -4,6 +4,8 @@
 Fish (F), Mark (M), DeadNotBuried (D)
 ===============================================================================
 * NeoStats * Version 3.0.a3-dev
+ - Fix a potential security vulnerbility with user supplied strings (F)
+ - NeoStats now compiles and runs on Mac OSX (Tiger) (F)
  - Introduce module override to allow a module bot to become the primary source
    of signon CTCP version requests. (M)
  - Add broadcast forms of CTCP events so that modules can watch just their own 

Modified: trunk/include/neostats.h
==============================================================================
--- trunk/include/neostats.h	(original)
+++ trunk/include/neostats.h	Fri Sep  9 21:07:54 2005
@@ -1221,6 +1221,7 @@
 char *strlwr( char *s );
 EXPORTFUNC void AddStringToList( char ***List, char S[], int *C );
 EXPORTFUNC void strip_mirc_codes( char *text );
+EXPORTFUNC void clean_string(char *text, size_t len);
 EXPORTFUNC char *sctime( time_t t );
 EXPORTFUNC char *sftime( time_t t );
 EXPORTFUNC char *make_safe_filename( char *name );

Modified: trunk/modules/connectserv/cs.c
==============================================================================
--- trunk/modules/connectserv/cs.c	(original)
+++ trunk/modules/connectserv/cs.c	Fri Sep  9 21:07:54 2005
@@ -289,6 +289,10 @@
 	va_start( ap, fmt );
 	ircvsnprintf( buf, BUFSIZE, fmt, ap );
 	va_end( ap );
+
+	/* make sure the user can't use format specifers to crash/buffer overflow */
+	clean_string(buf, BUFSIZE);
+	
 	irc_chanalert( cs_bot, buf );
 	if( cs_cfg.logging ) 
 		nlog( LOG_NORMAL, buf );

Modified: trunk/src/misc.c
==============================================================================
--- trunk/src/misc.c	(original)
+++ trunk/src/misc.c	Fri Sep  9 21:07:54 2005
@@ -363,6 +363,44 @@
 	*dd = 0;
 }
 
+/** @brief clean_string
+ * 
+ *  cleans up a string, escaping some vars that could be used to
+ *  crash neostats (like format strings, %s %d etc)
+ * 
+ *  @param text to clean
+ *
+ *  @returns none
+ */
+
+void clean_string( char *text, size_t len )
+{
+	char *dd, *start, *orig; 
+	int i = 0;
+	dd = malloc(len);	
+	start = dd;
+	orig = text;
+	
+	while( *text ) {
+		i++;
+		switch( *text ) {
+			case '%':
+				/* if our final length is bigger than the buffer, then we just 
+				 * drop the char */
+				if ( (i+1) <= len) {
+					*dd++ = '%';
+				} else {
+					*text++;
+				}
+				break;
+		}
+		*dd++ = *text++;		/* Move on to the next char */
+	}
+	*dd = 0;
+	strncpy(orig,start,len);
+	free(start);	
+}
+
 /** @brief sctime
  * 
  *