Skip to content
Snippets Groups Projects
  1. Apr 09, 2023
    • Rob Swindell's avatar
      Fix 20+ year old bug that allowed getstr(... K_WRAP) to overflow wordwrap buf · 63406890
      Rob Swindell authored
      The sbbs_t::wordwrap[] buffer was 81 characters (80 printable characters, plus
      NUL terminator) and sbbs_t.getstr(), when used with the K_WRAP mode flag could
      potentially write more than 81 characters to this buffer (e.g. when using a
      wider than 80 column terminal and writing a message with the internal line
      editor which calls sbbs_t::getstr(... K_WRAP)) - would corrupt sbbs_t members
      after wordwrap[], which included pointers that would be freed in the sbbs_t
      destructor (~sbbs_t) and subsequently page/segfault as seen in issue #545.
      
      This change increases the wordwrap buffer to likely twice the same needed
      (maximum columns + NUL terminator) and adds wordwrap bounds checking to
      sbbs_t::getstr().
      
      There were comments indicating crash sightings in the sbsb_t destructor going
      back to 2002, so this commit removes those comments.
      
      Thanks to Nelgin for providing the gdb dump details ('print *this') that was
      the clue needed to reach the root-cause determination.
      
      This fixes issue #545.
      63406890
  2. Apr 08, 2023
  3. Apr 06, 2023
  4. Apr 05, 2023
  5. Apr 04, 2023
    • Rob Swindell's avatar
      Fix double-free race condition with SBBSCTRL upon global recycle · 28fa44ed
      Rob Swindell authored
      When multiple servers are recycling at the same time, (e.g. due to saved
      change in SCFG) they'd each call sbbs_read_ini() with a shared global_startup
      struct, which in turn calls sbbs_free_ini(), which would free all the
      allocated network interface lists (including the global_startup one) using
      iniFreeStringList (just a wrapper for strListFree), but iniFreeStringList()
      does NOT modify (NULLify) the freed-pointer, so your second or third server
      that called sbbs_read_ini(), with the shared MainForm->global structure, would
      *again* free the same global interface list. This bug actually has always
      existed because get_ini_globals() freed the global interface list in the same
      way, except it *immediately* re-allocated a new one by calling
      iniGetStringList(), so the time window (opportunity) for this race condition
      to occur was much smaller. Truly, SBBSCTRL should use a mutex or other
      mechanism to protect the shared global_startup struct, but this is a first
      step to a full fix: sbbs_free_ini() should (and now does) nullify the freed
      network interface pointers by using strListFree() directly. I haven't been
      able to reproduce the crash upon recycle in SBBSCTRL after making this change.
      28fa44ed
    • Rob Swindell's avatar
  6. Apr 03, 2023
  7. Apr 02, 2023
  8. Apr 01, 2023
  9. Mar 31, 2023
  10. Mar 29, 2023
  11. Mar 28, 2023
  12. Mar 27, 2023
  13. Mar 26, 2023
  14. Mar 25, 2023
Loading