* serv_chat.c: fix another overrun that could cause sessions to hang,

          and cleaned up some other strncpy()-related stuff. DON'T FORGET TO
          NULL-TERMINATE DESTINATION BUFFERS AFTER STRNCPY CALLS.

diff --git a/citadel/ChangeLog b/citadel/ChangeLog
index 9671d5f0bcbb30968e2249b4bff8e32e31862024..21bdf45be22ee4a3c1e0d5f2d0034a678f41d014 100644 (file)
--- a/citadel/ChangeLog
+++ b/citadel/ChangeLog
@@ -5,6 +5,9 @@ Fri Oct  9 18:34:06 EDT 1998 Art Cancro <ajc@uncnsrd.mt-kisco.ny.us>
 
 1998-10-09 Nathan Bryant <bryant@cs.usm.maine.edu>
        * serv_chat.c: fix buffer overrun that was resulting in segv's
+       * serv_chat.c: fix another overrun that could cause sessions to hang,
+         and cleaned up some other strncpy()-related stuff. DON'T FORGET TO
+         NULL-TERMINATE DESTINATION BUFFERS AFTER STRNCPY CALLS.
 
 Fri Oct  9 13:22:37 EDT 1998 Art Cancro <ajc@uncnsrd.mt-kisco.ny.us>
        * Implemented "lazy mode" traversal - pressing the space bar will do

diff --git a/citadel/serv_chat.c b/citadel/serv_chat.c
index 2d1a75f8e4799daa7e4469f0fe7730f9f563aa6c..d248a07e57a2bd014548902d5142d23250eb3399 100644 (file)
--- a/citadel/serv_chat.c
+++ b/citadel/serv_chat.c
@@ -99,7 +99,11 @@ void allwrite(char *cmdbuf, int flag, char *roomname, char *username)
        strncpy(clnew->chat_room, roomname, sizeof clnew->chat_room);
        clnew->chat_room[sizeof clnew->chat_room - 1] = 0;
        if (username)
-          strncpy(clnew->chat_username, username, 31); 
+         {
+           strncpy(clnew->chat_username, username,
+                   sizeof clnew->chat_username);
+           clnew->chat_username[sizeof clnew->chat_username - 1] = 0;
+         }
        else
           clnew->chat_username[0] = '\0';
        strcpy(clnew->chat_text, bcast);
@@ -310,7 +314,9 @@ void cmd_chat(char *argbuf)
                              strcpy(CC->chat_room, "Main room");
                           else
                           {
-                             strncpy(CC->chat_room, &cmdbuf[6], ROOMNAMELEN);
+                             strncpy(CC->chat_room, &cmdbuf[6],
+                                     sizeof CC->chat_room);
+                             CC->chat_room[sizeof CC->chat_room - 1] = 0;
                           }
                           allwrite("<joining room>",0, CC->chat_room, NULL);
                           cprintf("\n");