9pfs/solanum-vs-hackint-and-charybdis
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ircd: substitution: fix overrun with unterminated '}' in format string

Browse source 
handle a variable following an unterminated variable better
This commit is contained in:
Simon Arlott 2017-07-26 22:52:51 +01:00
parent 169a1c3535
commit 1dfb080874
No known key found for this signature in database
GPG key ID: C8975F2043CA5D24
1 changed files with 11 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
ircd/substitution.c
View file

@ -116,7 +116,13 @@ char *substitution_parse(const char *fmt, rb_dlink_list *varlist)
/* break out ${var} */
for (pptr = ptr + 2; *pptr != '\0'; pptr++)
{
if (*pptr != '}')
if (*pptr == '$')
{
*vptr++ = '\0';
pptr--;
break;
}
else if (*pptr != '}')
*vptr++ = *pptr;
else
{
@ -125,9 +131,6 @@ char *substitution_parse(const char *fmt, rb_dlink_list *varlist)
}
}
s_assert(*varname != '\0');
s_assert(*pptr != '\0');
/* advance ptr by length of variable */
ptr += (pptr - ptr);
@ -142,6 +145,10 @@ char *substitution_parse(const char *fmt, rb_dlink_list *varlist)
break;
}
}
/* don't increment ptr into a following string if the '}' is missing */
if (*ptr == '\0')
break;
}
*bptr = '\0';