Changeset 828 for branches/ithildin-1.1/modules/ircd/protocols/shared/rfc1459_io.c

Timestamp:

11/26/08 02:51:23 (3 years ago)

Author:

wd

Message:

Prevent data that shoots past the buffer limit in 1459-style protocols from
being treated as a new command.

File:

• branches/ithildin-1.1/modules/ircd/protocols/shared/rfc1459_io.c (modified) (8 diffs)

branches/ithildin-1.1/modules/ircd/protocols/shared/rfc1459_io.c

@@ -22 +22 @@
     int ret = 0;
     char *s;
+    bool dirtybuffer;
 
     /* If we were force-called (ep is NULL) we assume there is data in our
@@ -35 +36 @@
 
         while (cp->buflen > 0) {
+            dirtybuffer = false;
             /* if the buffer is full but no terminating character (\n) is
                found, we cheat */
@@ -45 +47 @@
                     s++;
 
+                /* A command without a newline, add it and note that the
+                 * future contents of the buffer are dirty (handled below
+                 * when we pass out the data) */
                 if (s == cp->buf + cp->bufsize) {
                     cp->buf[cp->bufsize - 1] = '\n';
                     s = cp->buf + cp->bufsize - 1;
+                    dirtybuffer = true;
                 }
             } else {
@@ -55 +61 @@
                     break; /* no separator found, try reading some more */
             }
-            /* make a local copy of the packet, then pass it off to the parser. 
-             * Bump the rest of the contents of 'buf' down if we read more than
-             * we have parsed. */
+
             /* null-terminate and get rid of the [\r]\n sequence. */
             if (s > cp->buf && *(s - 1) == '\r')
@@ -63 +67 @@
             else
                 *s = '\0';
+
             log_debug("[%s] <%s< %s", ircd.me->name,
                     (cp->cli != NULL ? cp->cli->nick :
                      (cp->srv != NULL ? cp->srv->name : "")), cp->buf);
-            if ((ret = packet_parse(cp)) == IRCD_CONNECTION_CLOSED)
-                return (void *)ret; /* connection closed, stop immediately */
+            /* Don't parse the packet if the buffer is dirty, otherwise do
+             * call the parser. */
+            if (!(cp->flags & IRCD_CONNFL_DIRTYBUFFER))
+            {
+                if ((ret = packet_parse(cp)) == IRCD_CONNECTION_CLOSED)
+                    return (void *)ret; /* connection closed, stop immediately */
+            } else
+                cp->flags &= ~IRCD_CONNFL_DIRTYBUFFER;
+
             s++; /* increment s, now we see if our packet contains more data */
             if (s - cp->buf < cp->buflen) {
@@ -77 +89 @@
                 *cp->buf = '\0'; /* zero it out */
             }
+
+            /* If the buffer is marked dirty, set the flag now on the
+             * connection (since we have passed off the previous command) */
+            if (dirtybuffer)
+                cp->flags |= IRCD_CONNFL_DIRTYBUFFER;
 
             if (ret == IRCD_PROTOCOL_CHANGED)
@@ -128 +145 @@
             buf[sm.len++] = ' ';
 
-        sm.len += vsnprintf(&buf[sm.len], MAX_PACKET_LEN - 3 - sm.len, msg,
-                args);
+        sm.len += vsnprintf(&buf[sm.len], MAX_PACKET_LEN - sm.len, msg, args);
     }
 
@@ -139 +155 @@
             (to != NULL ? to : ""), buf);
 
-    strcpy(&buf[sm.len], "\r\n");
-    sm.len += 2;
+    /* Terminate the command */
+    if (sm.len > MAX_PACKET_LEN - 2)
+        sm.len = MAX_PACKET_LEN - 2;
+    buf[sm.len++] = '\r';
+    buf[sm.len++] = '\n';
 
     return &sm;