Synchronet now requires the libarchive development package (e.g. libarchive-dev on Debian-based Linux distros, libarchive.org for more info) to build successfully.

Commit 79ad24f2 authored by rswindell's avatar rswindell

Using vsnprintf to avoid buffer overflows in var args functions.

parent 9de4ecc1
......@@ -122,12 +122,13 @@ int sbbs_t::rputs(char *str)
int sbbs_t::bprintf(char *fmt, ...)
{
va_list argptr;
char sbuf[1024];
char sbuf[4096];
if(!strchr(fmt,'%'))
return(bputs(fmt));
va_start(argptr,fmt);
vsprintf(sbuf,fmt,argptr);
if(vsnprintf(sbuf,sizeof(sbuf),fmt,argptr)<0)
sbuf[sizeof(sbuf)-1]=0; /* force termination */
va_end(argptr);
return(bputs(sbuf));
}
......@@ -138,10 +139,11 @@ int sbbs_t::bprintf(char *fmt, ...)
int sbbs_t::rprintf(char *fmt, ...)
{
va_list argptr;
char sbuf[1024];
char sbuf[4096];
va_start(argptr,fmt);
vsprintf(sbuf,fmt,argptr);
if(vsnprintf(sbuf,sizeof(sbuf),fmt,argptr)<0)
sbuf[sizeof(sbuf)-1]=0; /* force termination */
va_end(argptr);
return(rputs(sbuf));
}
......
......@@ -80,7 +80,8 @@ int sbbs_t::exec_misc(csi_t* csi, char *path)
else
arglist[i]=*(char **)vp;
csi->ip+=4; }
vsprintf(tmp,str,(char*)arglist);
if(vsnprintf(tmp,sizeof(tmp),str,(char*)arglist)<0)
tmp[sizeof(tmp)-1]=0;
if(op==VAR_PRINTF)
putmsg(cmdstr(tmp,path,csi->str,buf),P_SAVEATR|P_NOABORT);
else {
......@@ -503,7 +504,8 @@ int sbbs_t::exec_misc(csi_t* csi, char *path)
else
arglist[i]=*(char **)vp;
csi->ip+=4; }
vsprintf(tmp,str,(char *)arglist);
if(vsnprintf(tmp,sizeof(tmp),str,(char *)arglist)<0)
tmp[sizeof(tmp)-1]=0;
cmdstr(tmp,path,csi->str,str);
if(pp)
*pp=copystrvar(csi,*pp,str);
......@@ -1312,7 +1314,8 @@ int sbbs_t::exec_misc(csi_t* csi, char *path)
arglist[i]=*(char **)vp;
csi->ip+=4;
}
vsprintf(tmp,str,(char *)arglist);
if(vsnprintf(tmp,sizeof(tmp),str,(char *)arglist)<0)
tmp[sizeof(tmp)-1]=0;
if(lp1 && *lp1) {
cmdstr(tmp,path,csi->str,str);
fwrite(str,1,strlen(str),(FILE *)*lp1);
......
......@@ -105,7 +105,7 @@ int main(int argc, char **argv)
smb.file[0]=0;
for(i=1;i<argc;i++)
if(argv[i][0]=='/')
if(argv[i][0]=='-')
switch(toupper(argv[i][1])) {
case 'M':
mode|=MAIL;
......
......@@ -155,7 +155,8 @@ static int lprintf(char *fmt, ...)
#endif
va_start(argptr,fmt);
vsprintf(sbuf,fmt,argptr);
if(vsnprintf(sbuf,sizeof(sbuf),fmt,argptr)<0)
sbuf[sizeof(sbuf)-1]=0;
va_end(argptr);
result=startup->lputs(sbuf);
......@@ -302,7 +303,9 @@ static int sockprintf(SOCKET sock, char *fmt, ...)
struct timeval tv;
va_start(argptr,fmt);
len=vsprintf(sbuf,fmt,argptr);
len=vsnprintf(sbuf,sizeof(sbuf),fmt,argptr);
if(len<0)
sbuf[sizeof(sbuf)-1]=0;
if(startup!=NULL && startup->options&FTP_OPT_DEBUG_TX)
lprintf("%04d TX: %s", sock, sbuf);
strcat(sbuf,"\r\n");
......
......@@ -60,7 +60,8 @@ static void dbprintf(BOOL error, private_t* p, char* fmt, ...)
return;
va_start(argptr,fmt);
vsprintf(sbuf,fmt,argptr);
if(vsnprintf(sbuf,sizeof(sbuf),fmt,argptr)<0)
sbuf[sizeof(sbuf)-1]=0;
va_end(argptr);
lprintf("%04u File %s%s",p->fp ? fileno(p->fp) : 0,error ? "ERROR: ":"",sbuf);
......
......@@ -60,7 +60,8 @@ static void dbprintf(BOOL error, private_t* p, char* fmt, ...)
return;
va_start(argptr,fmt);
vsprintf(sbuf,fmt,argptr);
if(vsnprintf(sbuf,sizeof(sbuf),fmt,argptr)<0)
sbuf[sizeof(sbuf)-1]=0;
va_end(argptr);
lprintf("%04d Socket %s%s",p->sock,error ? "ERROR: ":"",sbuf);
......
......@@ -115,7 +115,8 @@ static int lprintf(char *fmt, ...)
#endif
va_start(argptr,fmt);
vsprintf(sbuf,fmt,argptr);
if(vsnprintf(sbuf,sizeof(sbuf),fmt,argptr)<0)
sbuf[sizeof(sbuf)-1]=0;
va_end(argptr);
return(startup->lputs(sbuf));
}
......@@ -273,7 +274,9 @@ int sockprintf(SOCKET sock, char *fmt, ...)
struct timeval tv;
va_start(argptr,fmt);
len=vsprintf(sbuf,fmt,argptr);
len=vsnprintf(sbuf,sizeof(sbuf),fmt,argptr);
if(len<0)
sbuf[sizeof(sbuf)-1]=0;
if(startup->options&MAIL_OPT_DEBUG_TX)
lprintf("%04d TX: %s", sock, sbuf);
strcat(sbuf,"\r\n");
......
......@@ -152,7 +152,8 @@ int lprintf(char *fmt, ...)
return(0);
va_start(argptr,fmt);
vsprintf(sbuf,fmt,argptr);
if(vsnprintf(sbuf,sizeof(sbuf),fmt,argptr)<0)
sbuf[sizeof(sbuf)-1]=0;
va_end(argptr);
return(startup->lputs(sbuf));
}
......@@ -166,7 +167,8 @@ int eprintf(char *fmt, ...)
return(0);
va_start(argptr,fmt);
vsprintf(sbuf,fmt,argptr);
if(vsnprintf(sbuf,sizeof(sbuf),fmt,argptr)<0)
sbuf[sizeof(sbuf)-1]=0;
va_end(argptr);
return(startup->event_log(sbuf));
}
......
......@@ -225,15 +225,17 @@ int lprintf(char *fmat, ...)
char sbuf[256];
int chcount;
va_start(argptr,fmat);
chcount=vsprintf(sbuf,fmat,argptr);
va_end(argptr);
lputs(sbuf);
return(chcount);
va_start(argptr,fmat);
chcount=vsnprintf(sbuf,sizeof(sbuf),fmat,argptr);
if(chcount<0)
sbuf[sizeof(sbuf)-1]=0;
va_end(argptr);
lputs(sbuf);
return(chcount);
}
void bail(int code)
{
exit(code);
exit(code);
}
......
......@@ -136,7 +136,9 @@ int lprintf(char *fmat, ...)
int chcount;
va_start(argptr,fmat);
chcount=vsprintf(sbuf,fmat,argptr);
chcount=vsnprintf(sbuf,sizeof(sbuf),fmat,argptr);
if(chcount<0)
sbuf[sizeof(sbuf)-1]=0;
va_end(argptr);
lputs(sbuf);
return(chcount);
......
......@@ -120,7 +120,8 @@ static int lprintf(char *fmt, ...)
#endif
va_start(argptr,fmt);
vsprintf(sbuf,fmt,argptr);
if(vsnprintf(sbuf,sizeof(sbuf),fmt,argptr)<0)
sbuf[sizeof(sbuf)-1]=0;
va_end(argptr);
return(startup->lputs(sbuf));
}
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment