* sanitize cookie stuff

[citadel.git] / webcit / cookie_conversion.c

diff --git a/webcit/cookie_conversion.c b/webcit/cookie_conversion.c
index 24e29ce740872f44a6bda5601b6ddba7862b2bf2..fd3082b7902ce587403b2f0c2f276df2da15b64c 100644 (file)
--- a/webcit/cookie_conversion.c
+++ b/webcit/cookie_conversion.c
@@ -26,16 +26,17 @@ typedef unsigned char byte;       /**< Byte type */
  * \param pass his passphrase
  * \param room the room he wants to enter
  */
-void stuff_to_cookie(char *cookie, int session,
+void stuff_to_cookie(char *cookie, size_t clen, int session,
                char *user, char *pass, char *room)
 {
        char buf[SIZ];
        int i;
+       int len;
 
-       sprintf(buf, "%d|%s|%s|%s|", session, user, pass, room);
+       len = snprintf(buf, SIZ, "%d|%s|%s|%s|", session, user, pass, room);
        strcpy(cookie, "");
-       for (i=0; i<strlen(buf); ++i) {
-               sprintf(&cookie[i*2], "%02X", buf[i]);
+       for (i=0; (i < len) && (i * 2 < clen); ++i) {
+               snprintf(&cookie[i*2], clen - i * 2, "%02X", buf[i]);
        }
 }
 
@@ -49,13 +50,18 @@ int xtoi(char *in, size_t len)
 {
        int val = 0;
        char c = 0;
-       while (isxdigit((byte) *in) && (len-- > 0))
+       while (!IsEmptyStr(in) && isxdigit((byte) *in) && (len-- > 0))
        {
                c = *in++;
                val <<= 4;
-               val += isdigit((unsigned char)c)
-               ? (c - '0')
-               : (tolower((unsigned char)c) - 'a' + 10);
+               if (!isdigit((unsigned char)c)) {
+                       c = tolower((unsigned char) c);
+                       if ((c < 'a') || (c > 'f'))
+                               return 0;
+                       val += c  - 'a' + 10 ;
+               }
+               else
+                       val += c - '0';
        }
        return val;
 }
@@ -80,12 +86,24 @@ void cookie_to_stuff(char *cookie, int *session,
        int i, len;
 
        strcpy(buf, "");
-       len = strlen(cookie) * 2 ;
+       len = strlen(cookie) / 2;
        for (i=0; i<len; ++i) {
                buf[i] = xtoi(&cookie[i*2], 2);
                buf[i+1] = 0;
        }
 
+/* debug
+       char t[256];
+       extract_token(t, buf, 0, '|', sizeof t);
+       lprintf(9, "SESS: %s\n", t);
+       extract_token(t, buf, 1, '|', sizeof t);
+       lprintf(9, "USER: %s\n", t);
+       extract_token(t, buf, 2, '|', sizeof t);
+       lprintf(9, "PASS: %s\n", t);
+       extract_token(t, buf, 3, '|', sizeof t);
+       lprintf(9, "ROOM: %s\n", t);
+ debug */
+
        if (session != NULL)
                *session = extract_int(buf, 0);
        if (user != NULL)