From 1a27c109c3ca3630c7a8674d4667bee8f95460c7 Mon Sep 17 00:00:00 2001
From: Rob Swindell <rob@synchro.net>
Date: Thu, 3 Mar 2022 09:59:11 -0800
Subject: [PATCH] Safer string handling
e.g. CID 33631: Unbounded source buffer
---
src/sbbs3/filelist.c | 35 ++++++++++++-----------------------
1 file changed, 12 insertions(+), 23 deletions(-)
diff --git a/src/sbbs3/filelist.c b/src/sbbs3/filelist.c
index 39cb0819bb..540ee54420 100644
--- a/src/sbbs3/filelist.c
+++ b/src/sbbs3/filelist.c
@@ -1,4 +1,6 @@
/* Utility to create list of files from Synchronet file directories */
+/* DEPRECATED: use filelist.js instead */
+
/* Default list format is FILES.BBS, but file size, uploader, upload date */
/* and other information can be included. */
@@ -55,31 +57,18 @@ int lprintf(int level, const char *fmat, ...)
return(chcount);
}
-void stripctrlz(char *str)
-{
- char tmp[1024];
- int i,j,k;
-
- k=strlen(str);
- for(i=j=0;i<k;i++)
- if(str[i]!=0x1a)
- tmp[j++]=str[i];
- tmp[j]=0;
- strcpy(str,tmp);
-}
-
char* byteStr(unsigned long value)
{
static char tmp[128];
if(value>=(1024*1024*1024))
- sprintf(tmp, "%5.1fG", value/(1024.0*1024.0*1024.0));
+ SAFEPRINTF(tmp, "%5.1fG", value/(1024.0*1024.0*1024.0));
else if(value>=(1024*1024))
- sprintf(tmp, "%5.1fM", value/(1024.0*1024.0));
+ SAFEPRINTF(tmp, "%5.1fM", value/(1024.0*1024.0));
else if(value>=1024)
- sprintf(tmp, "%5.1fK", value/1024.0);
+ SAFEPRINTF(tmp, "%5.1fK", value/1024.0);
else
- sprintf(tmp, "%5luB", value);
+ SAFEPRINTF(tmp, "%5luB", value);
return tmp;
}
@@ -234,7 +223,8 @@ int main(int argc, char **argv)
printf("\nDirectory internal code must follow -not parameter.\n");
exit(1);
}
- sprintf(not[nots++],"%.8s",argv[i]);
+ SAFECOPY(not[nots], argv[i]);
+ nots++;
}
else if(!stricmp(argv[i],"-all")) {
if(dirnum!=-1) {
@@ -343,14 +333,14 @@ int main(int argc, char **argv)
,/* filespec: */pattern, /* time: */t, file_detail_extdesc, scfg.dir[i]->sort, &file_count);
if(misc&AUTO) {
- sprintf(str,"%sFILES.BBS",scfg.dir[i]->path);
+ SAFEPRINTF(str,"%sFILES.BBS",scfg.dir[i]->path);
if((out=fopen(str, omode)) == NULL) {
perror(str);
exit(1);
}
}
if(misc&HDR) {
- sprintf(fname,"%-*s %-*s Files: %4lu"
+ safe_snprintf(fname, sizeof(fname), "%-*s %-*s Files: %4lu"
,LEN_GSNAME,scfg.lib[scfg.dir[i]->lib]->sname
,LEN_SLNAME,scfg.dir[i]->lname, (ulong)smb.status.total_files);
fprintf(out,"%s\n",fname);
@@ -400,7 +390,7 @@ int main(int argc, char **argv)
}
if(misc&MINUS) {
- sprintf(str,"%s%s",scfg.dir[i]->path,file.name);
+ SAFEPRINTF2(str,"%s%s",scfg.dir[i]->path,file.name);
if(!fexistcase(str))
fputc('-',out);
else
@@ -411,8 +401,7 @@ int main(int argc, char **argv)
desc_off++;
if(misc&DFD) {
- // TODO: Fix to support alt-file-paths:
- sprintf(str,"%s%s",scfg.dir[i]->path,file.name);
+ SAFEPRINTF2(str,"%s%s",scfg.dir[i]->path,file.name);
desc_off += fprintf(out,"%s ",unixtodstr(&scfg,(time32_t)fdate(str),str));
}
--
GitLab