Commit graph

31 commits

Author SHA1 Message Date
2bb8923c6f Err, the race in io_output() doesn't double-free
The previous commit's message claims the race can lead to duplicated
output, use after free, then double-free.  That's correct only up to
the use after free.  There is no double-free.

Heap corruption (double-free?) has been observed in Changeling,
though.  Player logged in (still in sanctuary), map #, crashed within
removecc()'s free(io->data).  Partial backtrace:

    raise () from /lib64/libc.so.6
    abort () from /lib64/libc.so.6
    __libc_message () from /lib64/libc.so.6
    malloc_printerr () from /lib64/libc.so.6
    removecc (ioq=0x251fd10, cc=468) at ../src/lib/gen/ioqueue.c:350
    ioq_dequeue (ioq=0x251fd10, cc=468) at ../src/lib/gen/ioqueue.c:135
    io_output (iop=0x251fc90, wait=1) at ../src/lib/empthread/io.c:231
    recvclient (cmd=0x258d8e0 "", size=1024) at ../src/lib/player/recvclient.c:82
    getcommand (combufp=0x2557068 "map #1") at ../src/lib/player/empdis.c:84

I haven't been able to reproduce.

To hopefully catch ioqueue going south earlier, make ioq_dequeue()
oops when it can't dequeue as many bytes as requested.
2010-08-29 11:31:02 +02:00
73e25ff21e Update copyright notice 2010-01-19 08:40:17 +01:00
55c53b9add Hide struct io and implementation of struct ioqueue
Move struct io and struct ioqueue from ioqueue.h to ioqueue.c.
Declare incomplete struct ioqueue in ioqueue.h.
2009-07-19 14:11:52 -04:00
615681ce16 Don't use 0 as null pointer constant, part 1
Use NULL instead of 0, for clarity.  Except in pointer comparisons;
leave that to the next two commits.
2009-03-24 21:45:44 +01:00
35ef345ecb Update copyright notice 2009-02-08 09:33:18 +01:00
d702068457 Fix trailing whitespace 2008-09-17 21:31:40 -04:00
db02dda32f Update copyright notice 2008-01-19 10:15:37 +01:00
404095d2fa Trim system includes. 2007-08-18 17:03:14 +00:00
Ron Koenderink
af64cfd491 [_WIN32] (readv, writev, iovec): New. POSIX equivalents.
(ioq_makeiov, ioqtoiov): Compile unconditionally.
(io_output): Use POSIX code unconditionally.
[_WIN32] (ioq_makebuf): Remove.
2007-08-16 21:43:20 +00:00
a9c872f006 Back out the previous revision and remove the include of sys/types.h
instead.
2007-08-16 10:41:30 +00:00
Ron Koenderink
f835548ee7 Include sys/uio.h unconditionally. 2007-08-15 02:46:08 +00:00
63bdc89835 Update copyright notice. 2007-01-09 19:09:31 +00:00
acad2240e0 Fix the previous revision (system header inclusion cleanup), it
doesn't compile on crufty old systems.
2006-07-11 18:42:08 +00:00
e42053d928 Break inclusion cycle: prototypes.h and commands.h included each
other.  Ensure headers in include/ can be included in any order
(except for econfig-spec.h, which is special).  New header types.h to
help avoid inclusion cycles.  Sort include directives.  Remove some
superflous includes.
2006-07-10 06:37:23 +00:00
cee8e126a2 Remove declaration that should have been removed in rev. 1.9. Doc
fix.  register purge.
2006-04-30 13:20:48 +00:00
0c8c169f88 (s_char): Remove. Use signed char for small integers, plain char for
characters.
2006-04-29 16:25:17 +00:00
a988b907fc s_char purge directed by compiler warnings. 2006-04-29 06:41:45 +00:00
4515b84c59 COPYING duplicates information from README. Remove. Move GPL from
LICENSE to COPYING, because that's where it usually is.  Update all
the references to these files.
2006-01-21 19:48:41 +00:00
3e400c018c Update copyright notice. 2006-01-05 13:36:57 +00:00
3aebb68ee7 Include config.h. 2005-12-27 18:04:19 +00:00
7041932ae2 (ioq_destroy) [aix, NeXT]: Remove special case, which leaked memory,
because freeing it didn't work at some time.  Well, it either works
now, or we'll find out what's wrong.
2005-10-22 18:28:11 +00:00
4f59fc9967 Remove a bunch of redundant casts. 2005-06-12 06:31:48 +00:00
3a060d6056 [_WIN32] (loc_StripDels): Remove. Different behavior depending on the
platform is evil, and line editing is none of the server's business
anyway.  If your client can't deal with the delete key, well, here's a
nickel, kid, get yourself a better computer.
2005-06-11 16:44:01 +00:00
95234c8e9f (ioq_gets): Support telnet line termination "\r\n". Previously,
string input other than through parse() or getele() failed to strip
'\r', which could end up in ship names and such.
(getele): Code dealing with '\r' is now redundant, remove.  It ceased
to work in rev. 1.6 because input filtering replaces '\r' by '?'.
2005-06-11 16:38:58 +00:00
345ad3dfe0 Update copyright notice. 2005-03-16 22:03:16 +00:00
fac342ed49 Update copyright notice. 2004-09-07 15:07:16 +00:00
7c52730439 Don't cast void to void. 2004-03-01 13:56:07 +00:00
0696bb190d Indentation fix. 2004-02-06 23:26:25 +00:00
4ae9c417b3 (bzero, bcopy): Obsolete BSDisms; remove. Remove some calls without
effect.  Replace calls by struct assignment where possible.  Replace
clear buffer, copy string to buffer by strncpy().  Use assignment to
clear when that's clearer.  Replace overlapping copy through bounce
buffer by memmove().  Replace rest by standard memset() and memcpy().
Also use sizeof() instead of literal array sizes for robustness, and
instead of symbolic array sizes for clarity.
2004-01-08 17:54:28 +00:00
9b7adfbecc Indented with src/scripts/indent-emp. 2003-09-02 20:48:48 +00:00
d8b7fdfae1 Import of Empire 4.2.12 2003-08-23 12:23:04 +00:00