diff options
| -rw-r--r-- | lib/libalias/alias_irc.c | 16 | ||||
| -rw-r--r-- | sys/netinet/libalias/alias_irc.c | 16 |
2 files changed, 26 insertions, 6 deletions
diff --git a/lib/libalias/alias_irc.c b/lib/libalias/alias_irc.c index 84193e1..2f2c126 100644 --- a/lib/libalias/alias_irc.c +++ b/lib/libalias/alias_irc.c @@ -249,6 +249,7 @@ lFOUND_CTCP: if ( dcc_link ) { struct in_addr alias_address; /* Address from aliasing */ u_short alias_port; /* Port given by aliasing */ + int n; #ifndef NO_FW_PUNCH /* Generate firewall hole as appropriate */ @@ -256,17 +257,26 @@ lFOUND_CTCP: #endif alias_address = GetAliasAddress(link); - iCopy += snprintf(&newpacket[iCopy], + n = snprintf(&newpacket[iCopy], sizeof(newpacket)-iCopy, "%lu ", (u_long)htonl(alias_address.s_addr)); - if( iCopy >= sizeof(newpacket) ) { /* Truncated/fit exactly - bad news */ + if( n < 0 ) { + DBprintf(("DCC packet construct failure.\n")); + goto lBAD_CTCP; + } + if( (iCopy += n) >= sizeof(newpacket) ) { /* Truncated/fit exactly - bad news */ DBprintf(("DCC constructed packet overflow.\n")); goto lBAD_CTCP; } alias_port = GetAliasPort(dcc_link); - iCopy += snprintf(&newpacket[iCopy], + n = snprintf(&newpacket[iCopy], sizeof(newpacket)-iCopy, "%u", htons(alias_port) ); + if( n < 0 ) { + DBprintf(("DCC packet construct failure.\n")); + goto lBAD_CTCP; + } + iCopy += n; /* Done - truncated cases will be taken care of by lBAD_CTCP */ DBprintf(("Aliased IP %lu and port %u\n", alias_address.s_addr, (unsigned)alias_port)); } diff --git a/sys/netinet/libalias/alias_irc.c b/sys/netinet/libalias/alias_irc.c index 84193e1..2f2c126 100644 --- a/sys/netinet/libalias/alias_irc.c +++ b/sys/netinet/libalias/alias_irc.c @@ -249,6 +249,7 @@ lFOUND_CTCP: if ( dcc_link ) { struct in_addr alias_address; /* Address from aliasing */ u_short alias_port; /* Port given by aliasing */ + int n; #ifndef NO_FW_PUNCH /* Generate firewall hole as appropriate */ @@ -256,17 +257,26 @@ lFOUND_CTCP: #endif alias_address = GetAliasAddress(link); - iCopy += snprintf(&newpacket[iCopy], + n = snprintf(&newpacket[iCopy], sizeof(newpacket)-iCopy, "%lu ", (u_long)htonl(alias_address.s_addr)); - if( iCopy >= sizeof(newpacket) ) { /* Truncated/fit exactly - bad news */ + if( n < 0 ) { + DBprintf(("DCC packet construct failure.\n")); + goto lBAD_CTCP; + } + if( (iCopy += n) >= sizeof(newpacket) ) { /* Truncated/fit exactly - bad news */ DBprintf(("DCC constructed packet overflow.\n")); goto lBAD_CTCP; } alias_port = GetAliasPort(dcc_link); - iCopy += snprintf(&newpacket[iCopy], + n = snprintf(&newpacket[iCopy], sizeof(newpacket)-iCopy, "%u", htons(alias_port) ); + if( n < 0 ) { + DBprintf(("DCC packet construct failure.\n")); + goto lBAD_CTCP; + } + iCopy += n; /* Done - truncated cases will be taken care of by lBAD_CTCP */ DBprintf(("Aliased IP %lu and port %u\n", alias_address.s_addr, (unsigned)alias_port)); } |
