Prevent heap corruption by bounds-checking writes to opt[]
Since we are now free()ing the opt[] items in bail(), I've seen heap corruption core dumps after navigating the SCFG menus with some long configuration items (e.g. timed events with max-length command-lines). This heap corruption has been present for a long, long time, but not detected since we weren't free()ing these heap-allocated items. Increasing MAX_OPLN would have been a mitigation for this issue, but using snprintf(opt[n],MAX_OPLN,...) is the better fix.
parent
9c7ecc89
No related branches found
No related tags found
Showing
- src/sbbs3/scfg/scfg.c 10 additions, 10 deletionssrc/sbbs3/scfg/scfg.c
- src/sbbs3/scfg/scfgchat.c 25 additions, 25 deletionssrc/sbbs3/scfg/scfgchat.c
- src/sbbs3/scfg/scfgmsg.c 29 additions, 29 deletionssrc/sbbs3/scfg/scfgmsg.c
- src/sbbs3/scfg/scfgnet.c 2 additions, 2 deletionssrc/sbbs3/scfg/scfgnet.c
- src/sbbs3/scfg/scfgsys.c 128 additions, 128 deletionssrc/sbbs3/scfg/scfgsys.c
- src/sbbs3/scfg/scfgxtrn.c 67 additions, 67 deletionssrc/sbbs3/scfg/scfgxtrn.c
This diff is collapsed.
Please register or sign in to comment