* Fixed the crash problem. It wasn't AGUP/ASUP, but rather a buffer

          overrun in getuser() (thanks, Nathan).  Implemented overrun checks
          in getuser(), getroom(), and getfloor() to prevent future problems.

diff --git a/citadel/ChangeLog b/citadel/ChangeLog
index 6d67000e9d3c047aa4db69e68b9665899b6827af..1fc3c5dd9c4c1bcb0283adf1649179ccaad4cc85 100644 (file)
--- a/citadel/ChangeLog
+++ b/citadel/ChangeLog
@@ -1,8 +1,12 @@
+Mon Aug 17 20:01:18 EDT 1998 Art Cancro <ajc@uncnsrd.mt-kisco.ny.us>
+       * Fixed the crash problem.  It wasn't AGUP/ASUP, but rather a buffer
+         overrun in getuser() (thanks, Nathan).  Implemented overrun checks
+         in getuser(), getroom(), and getfloor() to prevent future problems.
+
 Mon Aug 17 00:06:52 EDT 1998 Art Cancro <ajc@uncnsrd.mt-kisco.ny.us>
        * Updated citmail.c with the latest stuff from the production system.
        * Implemented AGUP and ASUP commands, but AGUP crashes the server
          after its first successful use (user-not-found's don't affect it).
-         Haven't figured this one out yet...
 
 Thu Aug  6 19:25:01 EDT 1998 Art Cancro <ajc@uncnsrd.mt-kisco.ny.us>
        * Got the CitadelAPI library to the point where the server can start

diff --git a/citadel/room_ops.c b/citadel/room_ops.c
index f9b7461ab8c0e8801900ea3cef65383ea8db9dd8..154c7cc9486c27c3b7c509eb902698d926a3a298 100644 (file)
--- a/citadel/room_ops.c
+++ b/citadel/room_ops.c
@@ -77,7 +77,9 @@ void getroom(struct quickroom *qrbuf, int room_num)
        bzero(qrbuf, sizeof(struct quickroom));
        cdbqr = cdb_fetch(CDB_QUICKROOM, &room_num, sizeof(int));
        if (cdbqr != NULL) {
-               memcpy(qrbuf, cdbqr->ptr, cdbqr->len);
+               memcpy(qrbuf, cdbqr->ptr,
+                       ( (cdbqr->len > sizeof(struct quickroom)) ?
+                       sizeof(struct quickroom) : cdbqr->len) );
                cdb_free(cdbqr);
                }
        else {
@@ -147,7 +149,9 @@ void getfloor(struct floor *flbuf, int floor_num)
        bzero(flbuf, sizeof(struct floor));
        cdbfl = cdb_fetch(CDB_FLOORTAB, &floor_num, sizeof(int));
        if (cdbfl != NULL) {
-               memcpy(flbuf, cdbfl->ptr, cdbfl->len);
+               memcpy(flbuf, cdbfl->ptr,
+                       ( (cdbfl->len > sizeof(struct floor)) ?
+                       sizeof(struct floor) : cdbfl->len) );
                cdb_free(cdbfl);
                }
        else {

diff --git a/citadel/user_ops.c b/citadel/user_ops.c
index 1f61859b072cec24f5259bb3e20755cc815fe861..dcd3ddde7b443853641b5150b007536c89225ff0 100644 (file)
--- a/citadel/user_ops.c
+++ b/citadel/user_ops.c
@@ -54,7 +54,9 @@ int getuser(struct usersupp *usbuf, char name[]) {
                return(1);      /* user not found */
                }
 
-       memcpy(usbuf, cdbus->ptr, cdbus->len);
+       memcpy(usbuf, cdbus->ptr,
+               ( (cdbus->len > sizeof(struct usersupp)) ?
+               sizeof(struct usersupp) : cdbus->len) );
        cdb_free(cdbus);
        return(0);
        }
@@ -1116,12 +1118,10 @@ void cmd_agup(char *cmdbuf) {
                }
 
        extract(requested_user, cmdbuf, 0);
-       lprintf(9, "Requesting <%s>\n", requested_user);
        if (getuser(&usbuf, requested_user) != 0) {
                cprintf("%d No such user.\n", ERROR + NO_SUCH_USER);
                return;
                }
-       lprintf(9, "getuser() returned zero\n");
 
        cprintf("%d %s|%s|%u|%d|%d|%d|%ld\n", 
                OK,
@@ -1133,7 +1133,6 @@ void cmd_agup(char *cmdbuf) {
                (int)usbuf.axlevel,
                usbuf.usernum);
 
-       lprintf(9, "Done.\n");
        }