Change how the received client string length check is done before stripping newlines to avoid a potential buffer underflow.

2 files changed, 18 insertions, 4 deletions

diff --git a/TODO b/TODO
index 580fa95..ea24a8f 100644
--- a/TODO
+++ b/TODO
@@ -3,3 +3,19 @@ Support multiple connect commands.
 Support arrays or similar in the configuration file (for nick(s), connectcommand(s), etc.)
 
 All the TODOs sprinkled throughout the code!
+
+Use connecting/disconnecting IPs instead of fd numbers in NOTICEs and both in debug.
+
+Option to include date in replay log replay.
+
+(I think) replay log can cause non-existent user to appear in channel (e.g. ~19:00 on 12/08/2019 for me)
+
+Do server operator messages and commands work?
+
+Add BLABOUNCER HELP as a valid command to avoid the unrecognised command error.
+
+(I vaguely recall) some unwanted stuff (channel ban info?) was relayed to another client upon a client connecting.
+
+Change BLABOUNCER REPLAY to be D:H:M instead of D:H:M:S.
+
+PM replay chat in a channel (or perhaps a random channel?) e.g. replay on 06/09/2019 at 17:05 from 13:49 in #insomnia - maybe a client thing.
diff --git a/blabouncer.c b/blabouncer.c
index ecd8d00..e0c41f8 100644
--- a/blabouncer.c
+++ b/blabouncer.c
@@ -826,10 +826,8 @@ void dochat(int *serversockfd, int *clientsockfd, struct settings *settings) {
             clientbuf[clientnumbytes] = '\0'; // TODO make sure this can't overrun if some super long line (max bytes?) was received
             // clear up any newlines - TODO - Should we be doing this?  If not, we can stop only doing truncation checks for the server in processrawstring().
             // Only check for newlines if the string length is at least one!
-            if (strlen(clientbuf) > 0) {
-              while (clientbuf[strlen(clientbuf) - 1] == '\n' || clientbuf[strlen(clientbuf) - 1] == '\r') {
-                clientbuf[strlen(clientbuf) - 1] = '\0';
-              }
+            while (strlen(clientbuf) > 0 && (clientbuf[strlen(clientbuf) - 1] == '\n' || clientbuf[strlen(clientbuf) - 1] == '\r')) {
+              clientbuf[strlen(clientbuf) - 1] = '\0';
             }
             debugprint(DEBUG_SOME, "BOUNCER-CLIENT RECEIVED: '%s'\n", clientbuf);