* Fixed buffer overrun problems in cmd_rchg(), cmd_hchg(), and cmd_uchg()

[citadel.git] / citadel / citserver.c

diff --git a/citadel/citserver.c b/citadel/citserver.c
index a2ee6e7e8de966c2fbed8349bda7b517fc1a87dd..0f96bf0686c25664e667996b97ad8f6d51fa1c18 100644 (file)
--- a/citadel/citserver.c
+++ b/citadel/citserver.c
@@ -275,7 +275,7 @@ void cmd_info(void) {
 
 void cmd_rchg(char *argbuf)
 {
-       char newroomname[ROOMNAMELEN];
+       char newroomname[256];
 
        extract(newroomname, argbuf, 0);
        newroomname[ROOMNAMELEN-1] = 0;
@@ -291,10 +291,9 @@ void cmd_rchg(char *argbuf)
 
 void cmd_hchg(char *argbuf)
 {
-       char newhostname[25];
+       char newhostname[256];
 
        extract(newhostname, argbuf, 0);
-       newhostname[24] = 0;
        if (strlen(newhostname) > 0) {
                safestrncpy(CC->fake_hostname, newhostname,
                        sizeof(CC->fake_hostname) );
@@ -305,29 +304,36 @@ void cmd_hchg(char *argbuf)
        cprintf("%d OK\n", OK);
 }
 
-void cmd_uchg(char *newusername)
+void cmd_uchg(char *argbuf)
 {
-   if (CC->usersupp.axlevel < 6) 
-   {
-      cprintf("%d You must be an Aide to use UCHG.\n",
-               ERROR+HIGHER_ACCESS_REQUIRED);
-      return;
-   }
-   if ((newusername) && (newusername[0]))
-   {
-      CC->cs_flags &= ~CS_STEALTH;
-      memset(CC->fake_username, 0, 32);
-      if (strncasecmp(newusername, CC->curr_user, strlen(CC->curr_user)))
-         safestrncpy(CC->fake_username, newusername, sizeof(CC->fake_username));
-   }
-   else
-   {
-      CC->fake_username[0] = '\0';
-      CC->cs_flags |= CS_STEALTH;
-   }
-   cprintf("%d\n",OK);
+
+       char newusername[256];
+
+       extract(newusername, argbuf, 0);
+
+       if (CC->usersupp.axlevel < 6) {
+               cprintf("%d You must be an Aide to masquerade your name.\n",
+                       ERROR+HIGHER_ACCESS_REQUIRED);
+               return;
+       }
+
+       if (strlen(newusername) > 0) {
+               CC->cs_flags &= ~CS_STEALTH;
+               memset(CC->fake_username, 0, 32);
+               if (strncasecmp(newusername, CC->curr_user,
+                               strlen(CC->curr_user)))
+                       safestrncpy(CC->fake_username, newusername,
+                               sizeof(CC->fake_username));
+       }
+       else {
+               CC->fake_username[0] = '\0';
+               CC->cs_flags |= CS_STEALTH;
+       }
+       cprintf("%d\n",OK);
 }
 
+
+
 /*
  * returns an asterisk if there are any express messages waiting,
  * space otherwise.