Skip to content
Snippets Groups Projects
Commit 5fd4f1ca authored by Rob Swindell's avatar Rob Swindell :speech_balloon:
Browse files

A close-parenthesis in a guru.dat response string would throw-off the parser

After a negative-match of a Guru expression, we were searching for the next
'(' anywhere in the subsequent chars of the file rather than just the next
line that started with an open-parenthesis character.

This bug was the secondary cause of the buffer-overflow crash addresseed in
commit 62e2280e which was triggered by my recent updates to the guru.dat.
parent 85aa5b03
No related branches found
No related tags found
1 merge request!463MRC mods by Codefenix (2024-10-20)
Pipeline #4164 passed
...@@ -1519,7 +1519,7 @@ void sbbs_t::guruchat(char* line, char* gurubuf, int gurunum, char* last_answer) ...@@ -1519,7 +1519,7 @@ void sbbs_t::guruchat(char* line, char* gurubuf, int gurunum, char* last_answer)
if(*ptr=='(') { if(*ptr=='(') {
ptr++; ptr++;
if(!guruexp(&ptr,cstr)) { if(!guruexp(&ptr,cstr)) {
while(*ptr && *ptr!='(' && ptr<gurubuf+len) while(*ptr && !(*ptr == '(' && *(ptr-1) == '\n') && ptr<gurubuf+len)
ptr++; ptr++;
continue; continue;
} }
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment