Re: Overflow in editor in Circlemud patch 15/And oneinOasis olc2.0

From: Nocturnal Occulto (ronnyi@ifi.uio.no)
Date: 06/24/99


George Greer wrote:

> On Thu, 24 Jun 1999, Nocturnal Occulto wrote:
>
> >Found another wierd bug in the shop editor for latest version of oasis.
> >First create one shop, save it. Then create another one, save it and
> >KABOOM.
> >Always crashes. Anybody found out why?
>
> It was fixed April 16th.
>
> Already part of the soon-to-be-bpl16:
>
>
> @@ -119,7 +119,7 @@ void string_add(struct descriptor_data *
>    smash_tilde(str);
>
>    if (!(*d->str)) {
> -    if (strlen(str) > d->max_str) {
> +    if (strlen(str) + 1 > d->max_str) {
>        send_to_char("String too long - Truncated.\r\n",
>                    d->character);
>        *(str + d->max_str) = '\0';
> @@ -128,7 +128,7 @@ void string_add(struct descriptor_data *
>      CREATE(*d->str, char, strlen(str) + 3);
>      strcpy(*d->str, str);
>    } else {
> -    if (strlen(str) + strlen(*d->str) > d->max_str) {
> +    if (strlen(str) + strlen(*d->str) + 1 > d->max_str) {
>        send_to_char("String too long.  Last line skipped.\r\n", d->character);
>        terminator = 1;
>      } else {
>

Hmm I have that too, yet it still crashes if one spams a huge buffer
long enough

ROnny


     +------------------------------------------------------------+
     | Ensure that you have read the CircleMUD Mailing List FAQ:  |
     |  http://qsilver.queensu.ca/~fletchra/Circle/list-faq.html  |
     +------------------------------------------------------------+



This archive was generated by hypermail 2b30 : 12/15/00 PST