[Pkg-silc-commits] r155 - in /silc-toolkit/trunk: debian/changelog lib/silcutil/silcconfig.c

[lunar at users.alioth.debian.org]

Author: lunar
Date: Tue Sep  4 10:07:07 2007
New Revision: 155

URL: http://svn.debian.org/wsvn/pkg-silc/?sc=1&rev=155
Log:
* Patch silcconfig.c to prevent to potential buffer overflow issues and add
  the ability to escape double quotes in configuration strings.

Modified:
    silc-toolkit/trunk/debian/changelog
    silc-toolkit/trunk/lib/silcutil/silcconfig.c

Modified: silc-toolkit/trunk/debian/changelog
URL: http://svn.debian.org/wsvn/pkg-silc/silc-toolkit/trunk/debian/changelog?rev=155&op=diff
==============================================================================
--- silc-toolkit/trunk/debian/changelog (original)
+++ silc-toolkit/trunk/debian/changelog Tue Sep  4 10:07:07 2007
@@ -2,8 +2,10 @@
 
   * Update debian/control to set Priority of libsilc-1.1-2-dbg to "extra", as
     the ftpmasters sorted it.
+  * Patch silcconfig.c to prevent to potential buffer overflow issues and add
+    the ability to escape double quotes in configuration strings.
 
- -- Jérémy Bobbio <lunar at debian.org>  Wed, 11 Jul 2007 14:14:27 +0200
+ -- Jérémy Bobbio <lunar at debian.org>  Tue, 04 Sep 2007 11:22:04 +0200
 
 silc-toolkit (1.1.2-2) unstable; urgency=low
 

Modified: silc-toolkit/trunk/lib/silcutil/silcconfig.c
URL: http://svn.debian.org/wsvn/pkg-silc/silc-toolkit/trunk/lib/silcutil/silcconfig.c?rev=155&op=diff
==============================================================================
--- silc-toolkit/trunk/lib/silcutil/silcconfig.c (original)
+++ silc-toolkit/trunk/lib/silcutil/silcconfig.c Tue Sep  4 10:07:07 2007
@@ -26,6 +26,8 @@
 #else
 #define SILC_CONFIG_DEBUG(fmt)
 #endif
+
+#define BUF_SIZE 255
 
 /* this is the option struct and currently it is only used internally to
  * the module and other structs. */
@@ -112,11 +114,14 @@
  * a separator is any non alphanumeric character nor "_" or "-" */
 static char *my_next_token(SilcConfigFile *file, char *to)
 {
+  unsigned int count = 0;
   register char *o;
   my_trim_spaces(file);
   o = file->p;
-  while (isalnum((int)*o) || (*o == '_') || (*o == '-'))
+  while ((isalnum((int)*o) || (*o == '_') || (*o == '-')) && count < BUF_SIZE) {
+    count++;
     *to++ = *o++;
+  }
   *to = '\0';
   file->p = o;
   return to;
@@ -130,24 +135,30 @@
   my_trim_spaces(file);
   o = file->p;
   if (*o == '"') {
-    char *quot = strchr(++o, '"');
-    int len = quot - o;
-    if (!quot) { /* XXX FIXME: gotta do something here */
-      printf("Bullshit, missing matching \"");
+    unsigned int count = 0;
+    char *d = to;
+    while (count < BUF_SIZE) {
+      o++;
+      if (*o == '"') {
+          break;
+      }
+      if (*o == '\\') {
+          o++;
+      }
+      count++;
+      *d++ = *o;
+    }
+    if (count >= BUF_SIZE) { /* XXX FIXME: gotta do something here */
+      fprintf(stderr, "Bullshit, missing matching \"");
       exit(1);
     }
-    if (len <= 0)
-      *to = '\0';
-    else {
-      strncpy(to, o, len);
-      to[len] = '\0';
-    }
+    *d = '\0';
     /* update stream pointer */
-    file->p = quot + 1;
-    return to;
-  }
-  /* we don't need quote parsing, fall-back to token extractor */
-  my_next_token(file, to);
+    file->p = o + 1;
+  } else {
+    /* we don't need quote parsing, fall-back to token extractor */
+    my_next_token(file, to);
+  }
   return to;
 }
 
@@ -454,7 +465,7 @@
 
   /* loop throught statements */
   while (1) {
-    char buf[255];
+    char buf[BUF_SIZE];
     SilcConfigOption *thisopt;
 
     /* makes it pointing to the next interesting char */