* the same for msgescputs

diff --git a/webcit/context_loop.c b/webcit/context_loop.c
index 032c82a603399aa453a5b8d07e04af46054c54bb..452edd2f0ba87bb87f1f55ad213a44bef7689c28 100644 (file)
--- a/webcit/context_loop.c
+++ b/webcit/context_loop.c
@@ -157,7 +157,7 @@ int GenerateSessionID(void)
 /*
  * Collapse multiple cookies on one line
  */
-int req_gets(int sock, char *buf, char *hold)
+int req_gets(int sock, char *buf, char *hold, size_t hlen)
 {
        int a, b;
 
@@ -177,7 +177,7 @@ int req_gets(int sock, char *buf, char *hold)
                        if (buf[a] == ';') {
                                // we don't refresh len, because of we 
                                // only exit from here.
-                               sprintf(hold, "Cookie: %s", &buf[a + 1]);
+                               snprintf(hold, hlen, "Cookie: %s", &buf[a + 1]);
                                buf[a] = 0;
                                b = 8;
                                while (isspace(hold[b]))
@@ -303,7 +303,7 @@ void context_loop(int sock)
         */
        memset(hold, 0, sizeof(hold));
        do {
-               if (req_gets(sock, buf, hold) < 0) return;
+               if (req_gets(sock, buf, hold, SIZ) < 0) return;
 
                /**
                 * Can we compress?

diff --git a/webcit/webcit.c b/webcit/webcit.c
index 7a80d54534e2e24e4ad4dfa138371a74ce137c61..420aa7b14816aed0a3d85b8d66b0846a98045d00 100644 (file)
--- a/webcit/webcit.c
+++ b/webcit/webcit.c
@@ -414,23 +414,42 @@ void jsescputs(char *strbuf)
  * \param target target buffer
  * \param strbuf source buffer
  */
-void msgesc(char *target, char *strbuf)
+void msgesc(char *target, size_t tlen, char *strbuf)
 {
-       int a, len;
+       int len;
+       char *tend;
+       char *send;
+       char *tptr;
+       char *sptr;
 
-       *target='\0';
-       len = strlen(strbuf);
-       for (a = 0; a < len; ++a) {
-               if (strbuf[a] == '\n')
-                       strcat(target, " ");
-               else if (strbuf[a] == '\r')
-                       strcat(target, " ");
-               else if (strbuf[a] == '\'')
-                       strcat(target, "&#39;");
-               else {
-                       strncat(target, &strbuf[a], 1);
+       target[0]='\0';
+       len = strlen (strbuf);
+       send = strbuf + len;
+       sptr = strbuf;
+       tptr = target;
+
+       while (!IsEmptyStr(sptr) && 
+              (sptr < send) &&
+              (tptr < tend)) {
+              
+               if (*sptr == '\n')
+                       *tptr = ' ';
+               else if (*sptr == '\r')
+                       *tptr = ' ';
+               else if (*sptr == '\'') {
+                       if (tend - tptr < 8)
+                               return;
+                       *(tptr++) = '&';
+                       *(tptr++) = '#';
+                       *(tptr++) = '3';
+                       *(tptr++) = '9';
+                       *tptr = ';';
+               } else {
+                       *tptr = *sptr;
                }
+               tptr++; sptr++;
        }
+       *tptr = '\0';
 }
 
 /**
@@ -447,7 +466,7 @@ void msgescputs1( char *strbuf)
        buflen = 3 * strlen(strbuf) + SIZ;
        outbuf = malloc( buflen);
        outbuf2 = malloc( buflen);
-       msgesc(outbuf, strbuf);
+       msgesc(outbuf, buflen, strbuf);
        stresc(outbuf2, buflen, outbuf, 0, 0);
        wprintf("%s", outbuf2);
        free(outbuf);
@@ -460,10 +479,12 @@ void msgescputs1( char *strbuf)
  */
 void msgescputs(char *strbuf) {
        char *outbuf;
+       size_t len;
 
        if (strbuf == NULL) return;
-       outbuf = malloc( (3 * strlen(strbuf)) + SIZ);
-       msgesc(outbuf, strbuf);
+       len =  (3 * strlen(strbuf)) + SIZ;
+       outbuf = malloc(len);
+       msgesc(outbuf, len, strbuf);
        wprintf("%s", outbuf);
        free(outbuf);
 }

diff --git a/webcit/webcit.h b/webcit/webcit.h
index cdb27d1a0a8be220a6eb4053fdccbb02812ee194..eeb4c5783d54948b6585e44d13c741dfa4eeaf0d 100644 (file)
--- a/webcit/webcit.h
+++ b/webcit/webcit.h
@@ -508,7 +508,7 @@ long stresc(char *target, long tSize, char *strbuf, int nbsp, int nolinebreaks);
 void escputs(char *strbuf);
 void url(char *buf);
 void escputs1(char *strbuf, int nbsp, int nolinebreaks);
-void msgesc(char *target, char *strbuf);
+void msgesc(char *target, size_t tlen, char *strbuf);
 void msgescputs(char *strbuf);
 void msgescputs1(char *strbuf);
 void stripout(char *str, char leftboundary, char rightboundary);