From: Egor <egor@patchysicp.xyz>
Date: Mon, 2 May 2022 20:35:06 +0000 (+0300)
Subject: fix setNick buffer overrun
X-Git-Url: https://git.patchysicp.xyz/?a=commitdiff_plain;h=19adab1f7928c606f072bfe38b13daa984306e73;p=patchyircd.git

fix setNick buffer overrun
---

diff --git a/irc.c b/irc.c
index b364243..5531448 100644
--- a/irc.c
+++ b/irc.c
@@ -5,22 +5,23 @@ struct dynarr databuf;
 const char *hostname = "irc.patchysicp.xyz";
 int processPacket(struct client_data *client) {
 	char *source = NULL;
+	(void)source;
 	char *command = NULL;
 	char *args[16] = {0};
 	int argc = 0;
 	{
 		char *p = client->buf;
 		{ // remove \r
-			char *end = strchr(p, '\n');
-			if (!end) {
+			char *end = memchr(p, '\n', client->bufLen);
+			if (end > p && end[-1] == '\r')
+				*--end = '\n';
+			if (memchr(p, '\0', end-p)) {
 				printf("Client %"PRISocket" sent a NULL\n", client->FD);
 				fflush(stdout);
 				killConnection(client, false);
 				return 1; // null detected
 			}
-			if (end > p && end[-1] == '\r')
-				end[-1] = '\n';
-			if (strchr(p, '\r')) {
+			if (memchr(p, '\r', end-p)) {
 				printf("Client %"PRISocket" sent an extra CR\n", client->FD);
 				fflush(stdout);
 				killConnection(client, false);
@@ -255,14 +256,9 @@ void setNick(struct client_data *client, char* nickname, size_t size) {
 	size_t i;
 	// TODO: perform basic sanitization
 
-	// Remove newline
-	for(i=0;i<size;i++){
-		// Space
-		if(nickname[i] == ' ') {
-			nickname[i] = 0;
-			break;
-		}
-	}
+	char *bruh = strchr(nickname, ' '); // FIXME: we should reject those tbh
+	if (*bruh)
+		*bruh = 0;
 
 	// Start GitHub Copilot
 	// Check if the nickname is already taken
diff --git a/net.c b/net.c
index 370ab14..90dd901 100644
--- a/net.c
+++ b/net.c
@@ -75,7 +75,6 @@ void killConnection(struct client_data *cl, bool byChoice) {
 void recvProc(struct client_data *cl) {
 	ssize_t bytesRead;
 	char *x;
-	char tmp;
 	int packetReturn;
 	while(1){
 		// I hate you
@@ -98,14 +97,11 @@ void recvProc(struct client_data *cl) {
 		while(1){
 			x = memchr(cl->buf, '\n', cl->bufLen);
 			if(!x) break;
-			tmp = *(x+1);
-			*(x+1) = '\0';
 			packetReturn = processPacket(cl);
 			// Client QUIT
 			if(packetReturn == 1) {
 				return;
 			}
-			*(x+1) = tmp;
 			memmove(cl->buf, x+1, cl->buf + cl->bufLen-(x+1));
 			cl->bufLen -= x+1 - cl->buf;
 		}