empire/empserver
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

(coun_cmd): Multiple client commands could overrun player->client[].

Browse source 
Reported by Luigi Auriemma.
This commit is contained in:
Markus Armbruster 2006-05-13 07:56:12 +00:00
parent 256025736c
commit f70b64d91b
1 changed files with 10 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

14
src/lib/player/login.c
View file

@ -133,17 +133,23 @@ player_login(void *ud)
static int static int
client_cmd(void) client_cmd(void)
{ {
int i; int i, sz;
char *p, *end;
if (!player->argp[1]) if (!player->argp[1])
return RET_SYN; return RET_SYN;
p = player->client;
end = player->client + sizeof(player->client) - 1;
for (i = 1; player->argp[i]; ++i) { for (i = 1; player->argp[i]; ++i) {
if (i > 1) if (i > 1)
strncat(player->client, " ", sizeof(player->client) - 1); *p++ = ' ';
strncat(player->client, player->argp[i], sizeof(player->client) - 1); sz = strlen(player->argp[i]);
sz = MIN(sz, end - p);
memcpy(p, player->argp[i], sz);
p += sz;
} }
player->client[sizeof(player->client) - 1] = '\0'; *p = 0;
pr_id(player, C_CMDOK, "talking to %s\n", player->client); pr_id(player, C_CMDOK, "talking to %s\n", player->client);
return RET_OK; return RET_OK;
} }