-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
The checks in buffer.cpp were wrong (tim called getDataSize() insted of
getDataMaxSize) . here the whole patch3 rediffed against cvs and with the
right checks.
-----BEGIN PGP SIGNATURE-----
iD8DBQE9I6PkUMlRieHkprgRAiPEAKC8lru/ub954cuigt5vQUqmvGEEOACdFSaU
rqqz4ZCao/bFKvzC6ItcHdc=
=m98Y
-----END PGP SIGNATURE-----
Index: src/buffer.cpp
===================================================================
RCS file: /cvsroot/licq/licq/src/buffer.cpp,v
retrieving revision 1.12
diff -u -1 -b -p -r1.12 buffer.cpp
--- src/buffer.cpp 6 May 2002 01:51:26 -0000 1.12
+++ src/buffer.cpp 4 Jul 2002 01:17:09 -0000
@@ -456,2 +456,8 @@ char *CBuffer::PackUnsignedLong(unsigned
{
+ if ( getDataSize() + 4 > getDataMaxSize() )
+ {
+ gLog.Warn("%sPackUnsignedLong(): Trying to pack more data than "
+ "CBuffer can hold!\n", L_WARNxSTR);
+ return getDataPosWrite();
+ }
put_le_long(getDataPosWrite(), data);
@@ -463,2 +469,8 @@ char *CBuffer::PackUnsignedLongBE(unsign
{
+ if (getDataSize() + 4 > getDataMaxSize() )
+ {
+ gLog.Warn("%sPackUnsignedLongBE(): Trying to pack more data than "
+ "CBuffer can hold!\n", L_WARNxSTR);
+ return getDataPosWrite();
+ }
put_be_long(getDataPosWrite(), data);
@@ -470,2 +482,8 @@ char *CBuffer::PackChar(char data)
{
+ if (getDataSize() + 1 > getDataMaxSize())
+ {
+ gLog.Warn("%sPackChar(): Trying to pack more data than "
+ "CBuffer can hold!\n", L_WARNxSTR);
+ return getDataPosWrite();
+ }
*getDataPosWrite() = data;
@@ -477,2 +495,8 @@ char *CBuffer::Pack(const char *data, in
{
+ if ( getDataSize() + size > getDataMaxSize() )
+ {
+ gLog.Warn("%sPack(): Trying to pack more data than "
+ "CBuffer can hold!\n", L_WARNxSTR);
+ return getDataPosWrite();
+ }
if (!size) return getDataPosWrite();
@@ -485,2 +509,8 @@ char *CBuffer::Pack(CBuffer *buf)
{
+ if ( getDataSize() + buf->getDataSize() > getDataMaxSize() )
+ {
+ gLog.Warn("%sPack(): Trying to pack more data than "
+ "CBuffer can hold!\n", L_WARNxSTR);
+ return getDataPosWrite();
+ }
memcpy(getDataPosWrite(), buf->getDataStart(), buf->getDataSize());
@@ -503,2 +533,8 @@ char *CBuffer::PackString(const char *da
if (max > 0 && n > max) n = max;
+ if ( getDataSize() + n + 1 > getDataMaxSize() )
+ {
+ gLog.Warn("%sPackString(): Trying to pack more data than "
+ "CBuffer can hold!\n", L_WARNxSTR);
+ return getDataPosWrite();
+ }
put_le_short(getDataPosWrite(), n + 1);
@@ -514,2 +550,8 @@ char *CBuffer::PackUnsignedShort(unsigne
{
+ if ( getDataSize() + 2 > getDataMaxSize() )
+ {
+ gLog.Warn("%sPackUnsignedShort(): Trying to pack more data than "
+ "CBuffer can hold!\n", L_WARNxSTR);
+ return getDataPosWrite();
+ }
put_le_short(getDataPosWrite(), data);
@@ -521,2 +563,8 @@ char *CBuffer::PackUnsignedShortBE(unsig
{
+ if ( getDataSize() + 2 > getDataMaxSize() )
+ {
+ gLog.Warn("%sPackUnsignedShortBE(): Trying to pack more data than "
+ "CBuffer can hold!\n", L_WARNxSTR);
+ return getDataPosWrite();
+ }
put_be_short(getDataPosWrite(), data);
Index: src/icqd-chat.cpp
===================================================================
RCS file: /cvsroot/licq/licq/src/icqd-chat.cpp,v
retrieving revision 1.11
diff -u -1 -b -p -r1.11 icqd-chat.cpp
--- src/icqd-chat.cpp 24 May 2002 18:45:49 -0000 1.11
+++ src/icqd-chat.cpp 4 Jul 2002 01:17:09 -0000
@@ -552,3 +552,3 @@ CChatManager::CChatManager(CICQDaemon *d
if (fontUnderline) m_nFontFace |= FONT_UNDERLINE;
- strncpy(m_szFontFamily, fontFamily, 64);
+ strncpy(m_szFontFamily, fontFamily, sizeof(m_szFontFamily));
m_nFontSize = fontSize;
@@ -1849,3 +1849,3 @@ void CChatManager::ChangeFontFamily(cons
- strncpy(m_szFontFamily, f, 64);
+ strncpy(m_szFontFamily, f, sizeof(m_szFontFamily));
}
Index: src/icqd-srv.cpp
===================================================================
RCS file: /cvsroot/licq/licq/src/icqd-srv.cpp,v
retrieving revision 1.42
diff -u -1 -b -p -r1.42 icqd-srv.cpp
--- src/icqd-srv.cpp 3 Jul 2002 23:15:10 -0000 1.42
+++ src/icqd-srv.cpp 4 Jul 2002 01:17:11 -0000
@@ -1015,3 +1015,3 @@ bool CICQDaemon::ProcessSrvPacket(CBuffe
packet.print(buf));
- delete buf;
+ delete [] buf;
return false;
@@ -1168,3 +1168,3 @@ void CICQDaemon::ProcessServiceFam(CBuff
packet.print(buf));
- delete buf;
+ delete [] buf;
break;
@@ -1906,2 +1906,3 @@ void CICQDaemon::ProcessListFam(CBuffer
gLog.Error("%sUnable to parse contact list TLV, aborting!\n", L_ERRORxSTR);
+ delete [] szName;
return;
@@ -2022,3 +2023,3 @@ void CICQDaemon::ProcessVariousFam(CBuff
packet.print(buf));
- delete buf;
+ delete [] buf;
break;
@@ -2032,3 +2033,3 @@ void CICQDaemon::ProcessVariousFam(CBuff
packet.print(buf));
- delete buf;
+ delete [] buf;
break;
Index: src/icqd-udp.cpp
===================================================================
RCS file: /cvsroot/licq/licq/src/icqd-udp.cpp,v
retrieving revision 1.32
diff -u -1 -b -p -r1.32 icqd-udp.cpp
--- src/icqd-udp.cpp 10 Jan 2002 03:24:43 -0000 1.32
+++ src/icqd-udp.cpp 4 Jul 2002 01:17:12 -0000
@@ -1595,3 +1595,3 @@ unsigned short CICQDaemon::ProcessUdpPac
nCommand, packet.print(buf));
- delete buf;
+ delete [] buf;
break;
@@ -1616,3 +1616,3 @@ void CICQDaemon::ProcessSystemMessage(CB
gLog.Unknown("%sInvalid system message (UIN = 0):\n%s\n", L_UNKNOWNxSTR, packet.print(buf));
- delete buf;
+ delete [] buf;
}
