(sendcmd): Don't overflow buf[]. The bug was fairly harmless, because

[empserver] / src / client / expect.c

diff --git a/src/client/expect.c b/src/client/expect.c
index 19afc601bca7a73c4086c2c3172875ec369f4389..3d1429ccbc7814d202a25001f654261b6825c634 100644 (file)
--- a/src/client/expect.c
+++ b/src/client/expect.c
@@ -1,6 +1,6 @@
 /*
  *  Empire - A multi-player, client/server Internet based war game.
- *  Copyright (C) 1986-2006, Dave Pare, Jeff Bailey, Thomas Ruschak,
+ *  Copyright (C) 1986-2007, Dave Pare, Jeff Bailey, Thomas Ruschak,
  *                           Ken Stevens, Steve McClure
  *
  *  This program is free software; you can redistribute it and/or modify
@@ -19,9 +19,9 @@
  *
  *  ---
  *
- *  See the "LEGAL", "LICENSE", "CREDITS" and "README" files for all the
- *  related information and legal notices. It is expected that any future
- *  projects/authors will amend these files as needed.
+ *  See files README, COPYING and CREDITS in the root of the source
+ *  tree for related information and legal notices.  It is expected
+ *  that future projects/authors will amend these files as needed.
  *
  *  ---
  *
@@ -33,17 +33,24 @@
 
 #include <config.h>
 
-#include "misc.h"
-
+#include <ctype.h>
 #include <stdio.h>
+#include <stdlib.h>
 #include <string.h>
-#include <ctype.h>
-#include <sys/types.h>
 #ifndef _WIN32
+#include <sys/types.h>
 #include <sys/socket.h>
 #include <unistd.h>
-#else
-#include <winsock.h>
+#endif
+#include "misc.h"
+
+#ifdef _WIN32
+#define recv(sock, buffer, buf_size, flags) \
+       w32_recv((sock), (buffer), (buf_size), (flags))
+#define read(sock, buffer, buf_size) \
+       w32_recv((sock), (buffer), (buf_size), 0)
+#define write(sock, buffer, buf_size) \
+       w32_send((sock), (buffer), (buf_size), 0)
 #endif
 
 int
@@ -52,21 +59,15 @@ recvline(int s, char *buf)
     int size;
     char *p;
     int n;
-    int code;
     int newline;
     char *ptr;
     int cc;
 
     size = 1024;
-#ifndef _WIN32
     (void)alarm(30);
-#endif
     ptr = buf;
     n = recv(s, ptr, size, MSG_PEEK);
     if (n <= 0) {
-#ifdef _WIN32
-       errno = WSAGetLastError();
-#endif
        perror("recv");
        return 0;
     }
@@ -74,15 +75,8 @@ recvline(int s, char *buf)
     buf[n] = '\0';
     if ((p = strchr(ptr, '\n')) == NULL) {
        do {
-#ifndef _WIN32
            cc = read(s, ptr, n);
-#else
-           cc = recv(s, ptr, n, 0);
-#endif
            if (cc < 0) {
-#ifdef _WIN32
-               errno = WSAGetLastError();
-#endif
                perror("expect: read");
                return 0;
            }
@@ -92,9 +86,6 @@ recvline(int s, char *buf)
            }
            ptr += n;
            if ((n = recv(s, ptr, size, MSG_PEEK)) <= 0) {
-#ifdef _WIN32
-               errno = WSAGetLastError();
-#endif
                perror("recv");
                return 0;
            }
@@ -105,15 +96,8 @@ recvline(int s, char *buf)
        *p = 0;
     } else
        newline = 1 + p - ptr;
-#ifndef _WIN32
     cc = read(s, buf, newline);
-#else
-    cc = recv(s, buf, newline, 0);
-#endif
     if (cc < 0) {
-#ifdef _WIN32
-       errno = WSAGetLastError();
-#endif
        perror("expect: read #2");
        return 0;
     }
@@ -123,21 +107,12 @@ recvline(int s, char *buf)
        return 0;
     }
     buf[newline] = '\0';
-#ifndef _WIN32
     (void)alarm(0);
-#endif
-    if (!isxdigit(*buf)) {
+    if (!isxdigit(buf[0]) || buf[1] != ' ') {
        fprintf(stderr, "Malformed line %s\n", buf);
        return 0;
     }
-    if (isdigit(*buf))
-       code = *buf - '0';
-    else {
-       if (isupper(*buf))
-           *buf = tolower(*buf);
-       code = 10 + *buf - 'a';
-    }
-    return code;
+    return strtol(buf, NULL, 16);
 }
 
 int
@@ -151,20 +126,16 @@ void
 sendcmd(int s, char *cmd, char *arg)
 {
     char buf[128];
-    int cc;
-    int len;
+    int cc, len;
 
-    (void)sprintf(buf, "%s %s\n", cmd, arg != NULL ? arg : "");
-    len = strlen(buf);
-#ifndef _WIN32
+    len = snprintf(buf, sizeof(buf), "%s %s\n",
+                  cmd, arg != NULL ? arg : "");
+    if (len >= (int)sizeof(buf)) {
+       fprintf(stderr, "%s too long\n", cmd);
+       exit(1);
+    }
     cc = write(s, buf, len);
-#else
-    cc = send(s, buf, len, 0);
-#endif
     if (cc < 0) {
-#ifdef _WIN32
-       errno = WSAGetLastError();
-#endif
        perror("sendcmd: write");
     }
     if (cc != len) {