[PATCH] Add some bound checking and quoting to silcconfig.c

Jérémy Bobbio <[email protected]> Mon, 3 Sep 2007 15:46:32 +0200

Newsgroups	gmane.network.silc.devel
Message-ID	<[email protected]>

Hi!

In the making of a Debian package for silc-server, I needed to have some
mechanism to allow double quotes in configuration strings.

The attached patch (for silc-toolkit 1.1.1) adds this (using the usual
backslash) and it also add some bound checking for my_get_string and
my_next_token to avoid a buffer overflow.

The patch is less than optimal, but as the current configuration format
should go away with 1.2, it feels like enough for me.

Cheers,
-- 
Jérémy Bobbio                        .''`. 
[email protected]                    : :Ⓐ  :  # apt-get install anarchism
                                    `. `'` 
                                      `-

_______________________________________________________________________
Info:    https://lists.silcnet.org/mailman/listinfo/silc-announce
Archive: https://lists.silcnet.org/pipermail/silc-announce
FAQ:     http://silcnet.org/support/faq/

silc-toolkit-1.1.1-string-quoting.patch (text/plain, 2.1 KB)

Index: lib/silcutil/silcconfig.c
===================================================================
--- lib/silcutil/silcconfig.c	(revision 139)
+++ lib/silcutil/silcconfig.c	(working copy)
@@ -27,6 +27,8 @@
 #define SILC_CONFIG_DEBUG(fmt)
 #endif
 
+#define BUF_SIZE 255
+
 /* this is the option struct and currently it is only used internally to
  * the module and other structs. */
 typedef struct SilcConfigOptionStruct {
@@ -112,11 +114,14 @@
  * a separator is any non alphanumeric character nor "_" or "-" */
 static char *my_next_token(SilcConfigFile *file, char *to)
 {
+  unsigned int count = 0;
   register char *o;
   my_trim_spaces(file);
   o = file->p;
-  while (isalnum((int)*o) || (*o == '_') || (*o == '-'))
+  while ((isalnum((int)*o) || (*o == '_') || (*o == '-')) && count < BUF_SIZE) {
+    count++;
     *to++ = *o++;
+  }
   *to = '\0';
   file->p = o;
   return to;
@@ -130,24 +135,30 @@
   my_trim_spaces(file);
   o = file->p;
   if (*o == '"') {
-    char *quot = strchr(++o, '"');
-    int len = quot - o;
-    if (!quot) { /* XXX FIXME: gotta do something here */
-      printf("Bullshit, missing matching \"");
+    unsigned int count = 0;
+    char *d = to;
+    while (count < BUF_SIZE) {
+      o++;
+      if (*o == '"') {
+          break;
+      }
+      if (*o == '\\') {
+          o++;
+      }
+      count++;
+      *d++ = *o;
+    }
+    if (count >= BUF_SIZE) { /* XXX FIXME: gotta do something here */
+      fprintf(stderr, "Bullshit, missing matching \"");
       exit(1);
     }
-    if (len <= 0)
-      *to = '\0';
-    else {
-      strncpy(to, o, len);
-      to[len] = '\0';
-    }
+    *d = '\0';
     /* update stream pointer */
-    file->p = quot + 1;
-    return to;
+    file->p = o + 1;
+  } else {
+    /* we don't need quote parsing, fall-back to token extractor */
+    my_next_token(file, to);
   }
-  /* we don't need quote parsing, fall-back to token extractor */
-  my_next_token(file, to);
   return to;
 }
 
@@ -454,7 +465,7 @@
 
   /* loop throught statements */
   while (1) {
-    char buf[255];
+    char buf[BUF_SIZE];
     SilcConfigOption *thisopt;
 
     /* makes it pointing to the next interesting char */

signature.asc (application/pgp-signature, 189 B)

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFG3BA42PUjs9fQ72URAvHiAJoC2YahhaIVs0l3lORfGp9VmoOuEACdGHOM
CWiackZWt3/uI38va6+PJXA=
=SPbG
-----END PGP SIGNATURE-----