[Ayttm-commits] CVS: ayttm/modules/msn2/libmsn2 msn_bittybits.C,1.3,1.4 msn_core.C,1.10,1.11

[Colin Leroy <address@hidden>]

Update of /cvsroot/ayttm/ayttm/modules/msn2/libmsn2
In directory subversions:/tmp/cvs-serv20834/modules/msn2/libmsn2

Modified Files:
        msn_bittybits.C msn_core.C 
Log Message:
try to fight buffer overflows & read() timeouts


Index: msn_bittybits.C
===================================================================
RCS file: /cvsroot/ayttm/ayttm/modules/msn2/libmsn2/msn_bittybits.C,v
retrieving revision 1.3
retrieving revision 1.4
diff -u -r1.3 -r1.4
--- msn_bittybits.C     13 Jan 2003 10:32:25 -0000      1.3
+++ msn_bittybits.C     14 Jan 2003 15:12:13 -0000      1.4
@@ -10,6 +10,16 @@
 #include "msn_interface.h"
 #include "msn_bittybits.h"
 
+#include <errno.h>
+#include <signal.h>
+#include <setjmp.h>
+
+static sigjmp_buf jmpenv;
+static void timeout_handler(int sig)
+{
+       siglongjmp(jmpenv, 1);
+}
+
 char ** msn_read_line(int sock, int * numargs)
 {
   // Right, this is quite a task. Step One is to read the thing in.
@@ -19,12 +29,30 @@
 
   while(1)
   {
+    void (*prev_handler)(int);
+
+    alarm(0);
+    prev_handler = signal(SIGALRM, timeout_handler);
+    if (sigsetjmp(jmpenv, 1)) {
+           alarm(0);
+           signal(SIGALRM, prev_handler);
+           errno = ETIMEDOUT;
+           printf("Timeout !!!!!!!!!\n");
+           return NULL;
+    }
+    alarm(3);
+       
     if(read(sock, &c, 1)<1)
     {
       printf("What the..?!\n"); //DEBUG
       return NULL;
     }
-    if(c=='\r') { continue; }
+
+    alarm(0);
+    signal(SIGALRM, prev_handler);
+        
+    if(pos == 1249) {buf[pos]='\0'; continue; }
+    if(c=='\r' || pos > 1249) { continue; }
     if(c=='\n') { numspaces++; buf[pos]='\0'; break; }
     if(c==' ') { numspaces++; }
     buf[pos]=c;

Index: msn_core.C
===================================================================
RCS file: /cvsroot/ayttm/ayttm/modules/msn2/libmsn2/msn_core.C,v
retrieving revision 1.10
retrieving revision 1.11
diff -u -r1.10 -r1.11
--- msn_core.C  12 Jan 2003 00:06:47 -0000      1.10
+++ msn_core.C  14 Jan 2003 15:12:13 -0000      1.11
@@ -42,7 +42,7 @@
 llist * connections=NULL;
 
 int next_trid=10;
-char buf[1024]; // used for anything temporary
+char buf[1250]; // used for anything temporary
 
 char * errors[1000];
 char default_error_msg[]="Unknown error code";
@@ -777,6 +777,7 @@
   msglen=atoi(args[3]);
 
   msg=(char *)malloc(msglen+1);
+  memset(msg,'\0',msglen);
   read(conn->sock, msg, msglen);
   msg[msglen]='\0';
 
@@ -808,12 +809,14 @@
   if(!strcmp(content, "text/plain"))
   {
     message * msg=new message;
-    msg->header=mime;
-    msg->body=body;
+    msg->header=strdup(mime);
+    msg->body=strdup(body);
     msg->font=NULL;
     msg->content=msn_find_in_mime(mime, "Content-Type"); // include any 
"charset=" I've chopped off
-
     ext_got_IM(conn, args[1], msn_decode_URL(args[2]), msg);
+    free(msg->header);
+    free(msg->body);
+    delete msg;    
   } else if(!strcmp(content, "text/x-msmsgsinitialemailnotification")) {
     char * unread_ibc;
     char * unread_folc;