nethack-gwaa-kiwi/nethack
1
0
Fork 0
Code Pull Requests Activity

Pat Rankin wrote:

Browse Source 
> The `prompt' buffer in tty_yn_function still only holds QBUFSZ
> characters. But fixing the tty incarnation wouldn't be good enough;
> all the other interfaces would need to handle it too.  I think it
> should be fixed in the core instead.  Prompt strings simply should
> not be allowed to become so lengthy.

Another step in the fight against prompt sting buffer overflows.
The goes after the ones that may not have been found yet.

This makes yn_function a real core function and removes
the #define yn_function macro.

The yn_function validates the prompt string buffer being
passed prior to calling (*windowprocs.win_yn_function)(),
and if necessary, truncating it and adding "...".

This won't help if the overflow occurs in the core in
a buffer that is still QBUFSZ in size, but it will help if
a BUFSZ buffer is being passed to one of the query
functions.
This commit is contained in:
nethack.allison
2003-05-10 14:11:42 +00:00
parent 9746d9404e
commit 8f66986300
3 changed files with 33 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
include/extern.h
View File

@@ -178,6 +178,7 @@ E char NDECL(readchar);
#ifdef WIZARD
E void NDECL(sanity_check);
#endif
E char FDECL(yn_function, (const char *, const char *, CHAR_P));
/* ### dbridge.c ### */

7
include/winprocs.h
View File

@@ -108,7 +108,6 @@ extern NEARDATA struct window_procs windowprocs;
#define nh_poskey (*windowprocs.win_nh_poskey)
#define nhbell (*windowprocs.win_nhbell)
#define nh_doprev_message (*windowprocs.win_doprev_message)
#define yn_function (*windowprocs.win_yn_function)
#define getlin (*windowprocs.win_getlin)
#define get_ext_cmd (*windowprocs.win_get_ext_cmd)
#define number_pad (*windowprocs.win_number_pad)
@@ -122,6 +121,12 @@ extern NEARDATA struct window_procs windowprocs;
#define get_color_string (*windowprocs.win_get_color_string)
#endif
/* 3.4.2: There is a real yn_function() in the core now, which does
* some buffer length validation on the parameters prior to
* invoking the window port routine. yn_function() is in cmd.c
*/
/* #define yn_function (*windowprocs.win_yn_function) */
/* other defs that really should go away (they're tty specific) */
#define start_screen (*windowprocs.win_start_screen)
#define end_screen (*windowprocs.win_end_screen)

26
src/cmd.c
View File

@@ -2452,5 +2452,31 @@ wiz_port_debug()
# endif /*PORT_DEBUG*/
#endif /* OVL0 */
#ifdef OVLB
/*
* Parameter validator for generic yes/no function to prevent
* the core from sending too long a prompt string to the
* window port causing a buffer overflow there.
*/
char
yn_function(query,resp, def)
const char *query,*resp;
char def;
{
char qbuf[QBUFSZ];
unsigned truncspot, reduction = sizeof(" [N] ?") + 1;
if (resp) reduction += strlen(resp) + sizeof(" () ");
if (strlen(query) < (QBUFSZ - reduction))
return (*windowprocs.win_yn_function)(query, resp, def);
paniclog("Query truncated: ", query);
reduction += sizeof("...");
truncspot = QBUFSZ - reduction;
(void) strncpy(qbuf, query, truncspot);
qbuf[truncspot] = '\0';
Strcat(qbuf,"...");
return (*windowprocs.win_yn_function)(qbuf, resp, def);
}
#endif
/*cmd.c*/