Skip to content
Snippets Groups Projects
  1. Apr 14, 2023
    • Rob Swindell's avatar
      Use more appropriate typed-integer ini file get/set functions · 89f12cc2
      Rob Swindell authored
      I noticed when setting a security level's lines per message value > 32767
      in SCFG->System->Security Level Values, the value would be read back as 1 or
      or some other crazy value. That was because we were writing this value
      (and all the security level 16-bit values) using iniSetShortInt(). These are
      *unsigned* 16-bit values, so that we should have been using iniSetUShortInt().
      We'll just use iniSetUInteger() instead to fix that/those issues.
      
      And since promotion/conversion from uint16_t or uint32_t to uint has no impact
      when creating a decimal representation of a number, just use iniSetUInteger()
      everywhere we're setting unsigned integer settings in the main config .ini
      files. If/when these fields are made larger in the future, this code will just
      work.
      
      When reading .ini integers, use the more appropriate iniGet[U]Int16 functions
      instead of iniGet[U]Short and use iniGetUInteger for reading enums or any
      values that are immediately typecast to a uchar/uint8_t.
      
      Replaced some other use of [u]short that I found when searching with stdint.h
      types.
      89f12cc2
    • Rob Swindell's avatar
      84527be0
    • Rob Swindell's avatar
      Pass max_lines to editfile() and msgeditor() functions · 1a2011ec
      Rob Swindell authored
      Rather than recomputing (possibly differently) the max lines in multiple
      places.
      
      This also enables the possibility that editfile() could be used to edit files
      of > 10K lines in the future. <shrug>
      1a2011ec
    • Rob Swindell's avatar
      Clamp the security level lines per message value between 1 and 65535 · 0ecf245c
      Rob Swindell authored
      If a user's security level lines per message was set to '0', bad things would
      happen to the heap if the user posted/sent a message. '1' is a reasonable
      minimum value. If you don't want a user/group of users to send/post messages,
      there are restrictions for achieving that. Also this setting is (currently,
      at least) 16-bit, so clamp it there too on the high end.
      
      Also clamp the expire-to security level setting between 0 and 99, while we're
      here and noticed that this value wasn't being sanitized either.
      0ecf245c
  2. Apr 13, 2023
    • Rob Swindell's avatar
      When writing messages with a 'top' in raw-input-mode, don't add excessive CRLF · 2d9f8a32
      Rob Swindell authored
      If the top already ends in a blank line, no additional CRLF is warranted
      (between the 'top' and the raw-input message 'body').
      2d9f8a32
    • Rob Swindell's avatar
      Bounds-check the buffer being written in msgeditor() · ff386400
      Rob Swindell authored
      Replace the suspicious strcpy/strcat's in msgeditor(), the built-in line
      editor, with bounds-enforced snprintf() calls.
      Also, properly define MAX_LINE_LEN to account for the trailing \r\n on each
      line. It appears we've been under allocating the total possible message buffer
      size (by 2 bytes per line) for a while now.
      These 2 changes together should fix issue #547: apparent heap corruption due
      to 'buf' overflow in msgeditor().
      Also added a line count check/cap-enforcement with logged error message if
      exceeded (should never happen).
      
      Also fixed in this commit: off-by-one when enforcing max message length in
      msgeditor().
      
      Also added checks that the 'cols' (used in MAX_LINE_LEN) are reasonable values
      (40+), 2 was below the threshold of what would be expected to work since
      there is logic that deducts 4 from cols, for example.
      ff386400
    • Rob Swindell's avatar
      Fix false "SUSPECTED BOUNCE ATTACK ATTEMPT" for IPv6 FTP-data connections · 3e2c3176
      Rob Swindell authored
      This bug only impacted non-passive FTP connections. Using an FTP client
      with active (not passive) data connections over an IPv6 connection would
      false-trigger the "bounce attack" detection and the FTP server responded with
      "504 Bad port number" and logged a hack attempt in data/hack.log.
      
      The issue was that we were comparing the socket address structure (which
      contains other fields besides the address itself) between the control and
      proposed-data connections. While this logic worked okay for IPv4,
      it did not for IPv6 (the 2 structs contained some non-address differences).
      Rather than modify the socket address structures to match where needed, I'm
      just comparing the string representation of the addresses, since that's
      what we really care about anyway.
      
      Thank to "mark i" of Truck Stop BBS for alerting me to this issue
      3e2c3176
    • Deucе's avatar
      Allow overriding MIN_MAC_OSX_VERSION · 218a0ca5
      Deucе authored
      218a0ca5
    • Rob Swindell's avatar
      Make the '?' key pull up the online help too · a59d7d36
      Rob Swindell authored
      Sometimes F1 doesn't work, Ctrl-Z isn't documented, but there is a '?' displayed
      when help is available, so it's reasonable to assume someone might try/use it.
      a59d7d36
    • Rob Swindell's avatar
  3. Apr 11, 2023
  4. Apr 10, 2023
  5. Apr 09, 2023
    • Rob Swindell's avatar
    • Rob Swindell's avatar
      Fix typos · 773c986f
      Rob Swindell authored
      773c986f
    • Rob Swindell's avatar
      If XTRN.DAT can't be opened, try lowercase xtrn.dat · fc7d5cbc
      Rob Swindell authored
      This lowercase's the entire path.
      
      Fixes issue #543
      fc7d5cbc
    • Rob Swindell's avatar
      Fix 20+ year old bug that allowed getstr(... K_WRAP) to overflow wordwrap buf · 131f9d7c
      Rob Swindell authored
      The sbbs_t::wordwrap[] buffer was 81 characters (80 printable characters, plus
      NUL terminator) and sbbs_t.getstr(), when used with the K_WRAP mode flag could
      potentially write more than 81 characters to this buffer (e.g. when using a
      wider than 80 column terminal and writing a message with the internal line
      editor which calls sbbs_t::getstr(... K_WRAP)) - would corrupt sbbs_t members
      after wordwrap[], which included pointers that would be freed in the sbbs_t
      destructor (~sbbs_t) and subsequently page/segfault as seen in issue #545.
      
      This change increases the wordwrap buffer to likely twice the same needed
      (maximum columns + NUL terminator) and adds wordwrap bounds checking to
      sbbs_t::getstr().
      
      There were comments indicating crash sightings in the sbsb_t destructor going
      back to 2002, so this commit removes those comments.
      
      Thanks to Nelgin for providing the gdb dump details ('print *this') that was
      the clue needed to reach the root-cause determination.
      
      This fixes issue #545.
      131f9d7c
  6. Apr 08, 2023
  7. Apr 07, 2023
  8. Apr 06, 2023
  9. Apr 05, 2023
  10. Apr 04, 2023
Loading