Skip to content
Snippets Groups Projects
Commit 0ecf245c authored by Rob Swindell's avatar Rob Swindell :speech_balloon:
Browse files

Clamp the security level lines per message value between 1 and 65535

If a user's security level lines per message was set to '0', bad things would
happen to the heap if the user posted/sent a message. '1' is a reasonable
minimum value. If you don't want a user/group of users to send/post messages,
there are restrictions for achieving that. Also this setting is (currently,
at least) 16-bit, so clamp it there too on the high end.

Also clamp the expire-to security level setting between 0 and 99, while we're
here and noticed that this value wasn't being sanitized either.
parent 2d9f8a32
No related branches found
No related tags found
1 merge request!463MRC mods by Codefenix (2024-10-20)
......@@ -286,11 +286,11 @@ BOOL read_main_cfg(scfg_t* cfg, char* error, size_t maxerrlen)
cfg->level_timeperday[i] = iniGetInteger(section, NULL, "timeperday", i);
cfg->level_timepercall[i] = iniGetInteger(section, NULL, "timepercall", i);
cfg->level_callsperday[i] = iniGetInteger(section, NULL, "callsperday", i);
cfg->level_linespermsg[i] = iniGetInteger(section, NULL, "linespermsg", i);
cfg->level_linespermsg[i] = iniGetClampedInt(section, NULL, "linespermsg", 1, i, UINT16_MAX);
cfg->level_postsperday[i] = iniGetInteger(section, NULL, "postsperday", i);
cfg->level_emailperday[i] = iniGetInteger(section, NULL, "emailperday", i);
cfg->level_misc[i] = iniGetUInteger(section, NULL, "settings", 0);
cfg->level_expireto[i] = iniGetInteger(section, NULL, "expireto", 0);
cfg->level_expireto[i] = iniGetClampedInt(section, NULL, "expireto", 0, 0, 99);
cfg->level_freecdtperday[i] = iniGetBytes(section, NULL, "freecdtperday", 1, 0);
}
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment