Prevent buffer overruns in [get|put]user()

diff --git a/citadel/ChangeLog b/citadel/ChangeLog
index 7e99c4218e8438ce0853c4e6ad3a54acc5f91313..194baf859e98217cda987387770826d012a20014 100644 (file)
--- a/citadel/ChangeLog
+++ b/citadel/ChangeLog
@@ -1,3 +1,6 @@
+Wed Mar  3 00:00:55 EST 1999 Art Cancro <ajc@uncnsrd.mt-kisco.ny.us>
+       * Prevent buffer overruns in lowercase_name in [get|put]user()
+
 Sat Feb 27 07:47:36 EST 1999 Art Cancro <ajc@uncnsrd.mt-kisco.ny.us>
        * rooms.c: download_to_local_disk() prompts for a filename if a blank
          filename was supplied to it (for attachments without names)

diff --git a/citadel/msgbase.c b/citadel/msgbase.c
index d1b585a18fb1117a6ee3f3c14dce7c7273156f24..4f0ed4cad6246780b80e0b000c58c8d517566f7e 100644 (file)
--- a/citadel/msgbase.c
+++ b/citadel/msgbase.c
@@ -70,39 +70,27 @@ int alias(char *name)               /* process alias and routing info for mail */
        lprintf(9, "alias() called for <%s>\n", name);
 
        remove_any_whitespace_to_the_left_or_right_of_at_symbol(name);
-       
+
        fp=fopen("network/mail.aliases","r");
        if (fp==NULL) fp=fopen("/dev/null","r");
        if (fp==NULL) return(M_ERROR);
-GNA:   strcpy(aaa,""); strcpy(bbb,"");
-       do {
-               a=getc(fp);
-               if (a==',') a=0;
-               if (a>0) {
-                       b=strlen(aaa);
-                       aaa[b]=a;
-                       aaa[b+1]=0;
-                       }
-               } while(a>0);
-       do {
-               a=getc(fp);
-               if (a==10) a=0;
-               if (a>0) {
-                       b=strlen(bbb);
-                       bbb[b]=a;
-                       bbb[b+1]=0;
+       strcpy(aaa,""); strcpy(bbb,"");
+       while (fgets(aaa, sizeof aaa, fp)!=NULL) {
+               while (isspace(name[0])) strcpy(name, &name[1]);
+               aaa[strlen(aaa)-1] = 0;
+               strcpy(bbb, "");
+               for (a=0; a<strlen(aaa); ++a) {
+                       if (aaa[a] == ',') {
+                               strcpy(bbb, &aaa[a+1]);
+                               aaa[a] = 0;
+                               }
                        }
-               } while(a>0);
-       if (a<0) {
-               fclose(fp);
-               goto DETYPE;
+               if (!strcasecmp(name, aaa)) strcpy(name, bbb);
                }
-       if (strcasecmp(name,aaa)) goto GNA;
        fclose(fp);
-       strcpy(name,bbb);
        lprintf(7, "Mail is being forwarded to %s\n", name);
 
-DETYPE:        /* determine local or remote type, see citadel.h */
+       /* determine local or remote type, see citadel.h */
        for (a=0; a<strlen(name); ++a) if (name[a]=='!') return(M_INTERNET);
        for (a=0; a<strlen(name); ++a)
                if (name[a]=='@')
@@ -934,21 +922,15 @@ void save_message(char *mtmp,     /* file containing proper message */
 
        /* ...or if this is a private message, go to the target mailbox. */
        lprintf(9, "mailbox aliasing loop\n");
-lprintf(9, "1\n");
        if (strlen(recipient) > 0) {
-lprintf(9, "2\n");
                /* mailtype = alias(recipient); */
                if (mailtype == M_LOCAL) {
-lprintf(9, "3\n");
                        if (getuser(&userbuf, recipient)!=0) {
                                /* User not found, goto Aide */
-lprintf(9, "4\n");
                                strcpy(force_room, AIDEROOM);
                                }
                        else {
-lprintf(9, "5\n");
                                strcpy(hold_rm, actual_rm);
-lprintf(9, "6\n");
                                MailboxName(actual_rm, &userbuf, MAILROOM);
                                }
                        }
@@ -1177,7 +1159,9 @@ void cmd_ent0(char *entargs)
                        strcpy(buf,recipient);
                        }
                else strcpy(buf,"sysop");
+               lprintf(9, "calling alias()\n");
                e=alias(buf);                   /* alias and mail type */
+               lprintf(9, "alias() returned %d\n", e);
                if ((buf[0]==0) || (e==M_ERROR)) {
                        cprintf("%d Unknown address - cannot send message.\n",
                                ERROR+NO_SUCH_USER);
@@ -1209,7 +1193,7 @@ void cmd_ent0(char *entargs)
                /* Check to make sure the user exists; also get the correct
                * upper/lower casing of the name. 
                */
-               a = getuser(&tempUS,buf);
+               a = getuser(&tempUS, buf);
                if (a != 0) {
                        cprintf("%d No such user.\n",ERROR+NO_SUCH_USER);
                        return;

diff --git a/citadel/user_ops.c b/citadel/user_ops.c
index 8f3357f419a30cf08ad5a136f7af2335463ca23b..2a7f24d2765f795c85bc104253fabadecd31ff88 100644 (file)
--- a/citadel/user_ops.c
+++ b/citadel/user_ops.c
@@ -52,8 +52,10 @@ int getuser(struct usersupp *usbuf, char name[]) {
 
        memset(usbuf, 0, sizeof(struct usersupp));
        for (a=0; a<=strlen(name); ++a) {
-               lowercase_name[a] = tolower(name[a]);
+               if (a < sizeof(lowercase_name))
+                       lowercase_name[a] = tolower(name[a]);
                }
+       lowercase_name[sizeof(lowercase_name)-1] = 0;
 
        cdbus = cdb_fetch(CDB_USERSUPP, lowercase_name, strlen(lowercase_name));
        if (cdbus == NULL) {
@@ -92,8 +94,10 @@ void putuser(struct usersupp *usbuf, char *name)
        int a;
 
        for (a=0; a<=strlen(name); ++a) {
-               lowercase_name[a] = tolower(name[a]);
+               if (a < sizeof(lowercase_name))
+                       lowercase_name[a] = tolower(name[a]);
                }
+       lowercase_name[sizeof(lowercase_name)-1] = 0;
 
        cdb_store(CDB_USERSUPP,
                lowercase_name, strlen(lowercase_name),