From fccf1a5718fdcb9864bcbccf2eb6de7ee50d3dd3 Mon Sep 17 00:00:00 2001
From: "Rob Swindell (on Windows 11)" <rob@synchro.net>
Date: Mon, 7 Apr 2025 21:29:15 -0700
Subject: [PATCH] Better parsing of invalid @-codes
@-codes never start with a number (decimal digit)
@-codes never contain any whitespace (including tabs, CR and LF).
These 2 issues caused the stock batch file transfer menu for RIP terminals
to display all messed-up.
This RIP menu (text/menu/batchxfr.rip) contains @s and they triggered some
stripping of text and expanding to a text.dat string (!).
---
src/sbbs3/atcodes.cpp | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/src/sbbs3/atcodes.cpp b/src/sbbs3/atcodes.cpp
index 7a8f296731..1e0416c89e 100644
--- a/src/sbbs3/atcodes.cpp
+++ b/src/sbbs3/atcodes.cpp
@@ -126,12 +126,13 @@ int sbbs_t::show_atcode(const char *instr, JSObject* obj)
tp = strchr(str + 1, '@');
if (!tp) /* no terminating @ */
return 0;
- sp = strchr(str + 1, ' ');
- if (sp && sp < tp) /* space before terminating @ */
- return 0;
len = (tp - str) + 1;
(*tp) = 0;
sp = (str + 1);
+ if (IS_DIGIT(*sp)) // @-codes cannot start with a number
+ return 0;
+ if (strcspn(sp, " \t\r\n") != strlen(sp)) // white-space before terminating @
+ return 0;
if (*sp == '~' && *(sp + 1)) { // Mouse hot-spot (hungry)
sp++;
--
GitLab