bbs/deb-mbse
Archived
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fixed another buffer overflow in tic processing

Browse Source
This commit is contained in:
Michiel Broek 2008-03-14 20:09:37 +00:00
parent 1eac0936ac
commit 6b62be5284
4 changed files with 11 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
ChangeLog
View File

@ -2,6 +2,11 @@ $Id$
v0.95.3 12-Mar-2008
mbfido:
Fixed another buffer overflow thanks someone who is using a
tic processor that doesn't follow specs and doesn't create
proper ticfiles.
v0.95.2 17-Feb-2008 - 12-Mar-2008.

2
mbfido/orphans.c
View File

@ -50,7 +50,7 @@ void tidy_orphans(orphans **qal)
void fill_orphans(orphans **qal, char *TicName, char *Area, char *FileName, int Orphaned, int BadCRC)
{
orphans *tmp;
Syslog('-', "fill_orphans");
tmp = (orphans *)malloc(sizeof(orphans));
tmp->next = *qal;
snprintf(tmp->TicName, 13, TicName);

3
mbfido/ptic.c
View File

@ -71,7 +71,7 @@ int ProcessTic(fa_list **sbl, orphans **opl)
int First, Listed = FALSE, DownLinks = 0, MustRearc = FALSE;
int UnPacked = FALSE, IsArchive = FALSE, rc, i, j, k, File_Id = FALSE;
char *Temp, *unarc = NULL, *cmd = NULL;
char temp1[PATH_MAX], temp2[PATH_MAX], sbe[24], TDesc[256];
char temp1[PATH_MAX], temp2[PATH_MAX], sbe[24], TDesc[1024];
unsigned int crc, crc2, Kb;
sysconnect Link;
FILE *fp;
@ -587,7 +587,6 @@ int ProcessTic(fa_list **sbl, orphans **opl)
}
}
}
clean_tmpwork();
chdir(TIC.Inbound);

8
mbfido/tic.c
View File

@ -4,7 +4,7 @@
* Purpose ...............: Process .tic files
*
*****************************************************************************
* Copyright (C) 1997-2007
* Copyright (C) 1997-2008
*
* Michiel Broek FIDO: 2:280/2802
* Beekmansbos 10
@ -275,11 +275,11 @@ int LoadTic(char *inb, char *tfn, orphans **opl)
} else if (strncasecmp(Temp, "origin ", 7) == 0) {
strncpy(TIC.TicIn.Origin, Temp+7, 80);
strncpy(T_File.Origin, Temp+7, 80);
strncpy(T_File.Origin, Temp+7, 23);
} else if (strncasecmp(Temp, "from ", 5) == 0) {
strncpy(TIC.TicIn.From, Temp+5, 80);
strncpy(T_File.From, Temp+5, 80);
strncpy(T_File.From, Temp+5, 23);
} else if (strncasecmp(Temp, "file ", 5) == 0) {
strncpy(TIC.TicIn.File, Temp+5, 80);
@ -299,7 +299,7 @@ int LoadTic(char *inb, char *tfn, orphans **opl)
} else if (strncasecmp(Temp, "crc ", 4) == 0) {
TIC.Crc_Int = strtoul(Temp+4, (char **)NULL, 16);
snprintf(TIC.TicIn.Crc, 9, "%08X", TIC.Crc_Int);
strcpy(T_File.Crc, TIC.TicIn.Crc);
strncpy(T_File.Crc, TIC.TicIn.Crc, 8);
} else if (strncasecmp(Temp, "pw ", 3) == 0) {
strncpy(TIC.TicIn.Pw, Temp+3, 20);