Skip to content
Snippets Groups Projects
Commit 62e2280e authored by Rob Swindell's avatar Rob Swindell :speech_balloon:
Browse files

Fix buffer overflow in guru chat parsing engine

The trigger was this line in the recent change to guru.dat:
Unrealized potential. :-(

That open paren was parsed as the beginning of a new guru expression. A very
long guru expression that overflowed the stack variable 'str' here.
parent dd2c3701
No related branches found
No related tags found
1 merge request!463MRC mods by Codefenix (2024-10-20)
Pipeline #4150 passed
......@@ -1826,7 +1826,8 @@ bool sbbs_t::guruexp(char **ptrptr, char *line)
while((**ptrptr) && IS_WHITESPACE(**ptrptr))
(*ptrptr)++;
while((**ptrptr)!='|' && (**ptrptr)!='&' && (**ptrptr)!=')' &&(**ptrptr)) {
str[c++]=(**ptrptr);
if(c < sizeof(str) - 1)
str[c++]=(**ptrptr);
(*ptrptr)++;
}
str[c]=0;
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment