aboutsummaryrefslogtreecommitdiffstats
path: root/FICS/playerdb.c
diff options
context:
space:
mode:
Diffstat (limited to 'FICS/playerdb.c')
-rw-r--r--FICS/playerdb.c162
1 files changed, 116 insertions, 46 deletions
diff --git a/FICS/playerdb.c b/FICS/playerdb.c
index cda4e1a..c85ec0c 100644
--- a/FICS/playerdb.c
+++ b/FICS/playerdb.c
@@ -40,6 +40,12 @@
player_search().
Markus Uhlin 25/03/23 Fixed overflowed array index
read/write.
+ Markus Uhlin 25/03/29 player_remove_request:
+ fixed overflowed array index
+ read/write.
+ Markus Uhlin 25/04/02 add_to_list: added an upper
+ limit for the list size.
+ Markus Uhlin 25/04/06 Fixed Clang Tidy warnings.
*/
#include "stdinclude.h"
@@ -406,10 +412,14 @@ add_to_list(FILE *fp, enum ListWhich lw, int *size, int p)
#define SCAN_STR "%1023s"
- if (*size <= 0)
+ if (*size <= 0 || *size > MAX_GLOBAL_LIST_SIZE) {
+// warnx("%s: illegal list size (%d)", __func__, *size);
return -2;
+ }
+
while ((*size)-- > 0 && fscanf(fp, SCAN_STR, buf) == 1)
list_add(p, lw, buf);
+
return (*size <= 0 ? 0 : -1);
}
@@ -432,7 +442,7 @@ ReadV1PlayerFmt(int p, player *pp, FILE *fp, char *file, int version)
/*
* Name
*/
- if (fgets(tmp2, sizeof tmp2, fp) != NULL &&
+ if (fgets(tmp2, sizeof tmp2, fp) != NULL && // NOLINT
strcmp(tmp2, "NONE\n") != 0) {
tmp2[strcspn(tmp2, "\n")] = '\0';
pp->name = xstrdup(tmp2);
@@ -443,7 +453,7 @@ ReadV1PlayerFmt(int p, player *pp, FILE *fp, char *file, int version)
/*
* Full name
*/
- if (fgets(tmp2, sizeof tmp2, fp) != NULL &&
+ if (fgets(tmp2, sizeof tmp2, fp) != NULL && // NOLINT
strcmp(tmp2, "NONE\n") != 0) {
tmp2[strcspn(tmp2, "\n")] = '\0';
pp->fullName = xstrdup(tmp2);
@@ -454,7 +464,7 @@ ReadV1PlayerFmt(int p, player *pp, FILE *fp, char *file, int version)
/*
* Password
*/
- if (fgets(tmp2, sizeof tmp2, fp) != NULL &&
+ if (fgets(tmp2, sizeof tmp2, fp) != NULL && // NOLINT
strcmp(tmp2, "NONE\n") != 0) {
tmp2[strcspn(tmp2, "\n")] = '\0';
pp->passwd = xstrdup(tmp2);
@@ -465,7 +475,7 @@ ReadV1PlayerFmt(int p, player *pp, FILE *fp, char *file, int version)
/*
* Email
*/
- if (fgets(tmp2, sizeof tmp2, fp) != NULL &&
+ if (fgets(tmp2, sizeof tmp2, fp) != NULL && // NOLINT
strcmp(tmp2, "NONE\n") != 0) {
tmp2[strcspn(tmp2, "\n")] = '\0';
pp->emailAddress = xstrdup(tmp2);
@@ -473,7 +483,9 @@ ReadV1PlayerFmt(int p, player *pp, FILE *fp, char *file, int version)
pp->emailAddress = NULL;
}
- if (fscanf(fp, "%d %d %d %d %d %d %jd %d %jd %d %d %d %d %d %d %jd %d %jd "
+ if (feof(fp) ||
+ ferror(fp) ||
+ fscanf(fp, "%d %d %d %d %d %d %jd %d %jd %d %d %d %d %d %d %jd %d %jd "
"%d %d %d %d %d %d %jd %d %jd %d %d %d %d %d %d %jd %d %jd %d %d %d %d "
"%d %d %jd %d %jd %u\n",
&pp->s_stats.num, &pp->s_stats.win, &pp->s_stats.los,
@@ -575,6 +587,23 @@ ReadV1PlayerFmt(int p, player *pp, FILE *fp, char *file, int version)
pp->timeOfReg = array[0];
pp->totalTime = array[1];
+ if (pp->num_plan >= MAX_PLAN) {
+ warnx("Player %s is corrupt\nToo many plans (%d)",
+ parray[p].name,
+ pp->num_plan);
+ return;
+ } else if (pp->num_formula >= MAX_FORMULA) {
+ warnx("Player %s is corrupt\nToo many formulas (%d)",
+ parray[p].name,
+ pp->num_formula);
+ return;
+ } else if (pp->numAlias >= MAX_ALIASES) {
+ warnx("Player %s is corrupt\nToo many aliases (%d)",
+ parray[p].name,
+ pp->numAlias);
+ return;
+ }
+
if (pp->num_plan > 0) {
for (i = 0; i < pp->num_plan; i++) {
if (fgets(tmp2, sizeof tmp2, fp) == NULL) {
@@ -639,14 +668,13 @@ ReadV1PlayerFmt(int p, player *pp, FILE *fp, char *file, int version)
return;
}
- if (!(len = strlen(tmp2))) {
+ if (!strlen(tmp2)) { // XXX
fprintf(stderr, "FICS: Error bad alias in "
"file %s\n", file);
i--;
pp->numAlias--;
} else {
tmp2[strcspn(tmp2, "\n")] = '\0';
- tmp = tmp2;
tmp = eatword(tmp2);
*tmp = '\0';
tmp++;
@@ -831,9 +859,11 @@ got_attr_value_player(int p, char *attr, char *value, FILE *fp, char *file)
* num_plan
*/
- parray[p].num_plan = atoi(value);
-
- if (parray[p].num_plan > 0) {
+ if ((parray[p].num_plan = atoi(value)) >= MAX_PLAN) {
+ warnx("%s: %s: too many plans (%d)", __func__, file,
+ parray[p].num_plan);
+ return -1;
+ } else if (parray[p].num_plan > 0) {
for (i = 0; i < parray[p].num_plan; i++) {
if (fgets(tmp, sizeof tmp, fp) == NULL) {
@@ -855,15 +885,19 @@ got_attr_value_player(int p, char *attr, char *value, FILE *fp, char *file)
xstrdup(tmp) : NULL);
}
}
+ } else {
+ /* null */;
}
} else if (!strcmp(attr, "num_formula:")) {
/*
* num_formula
*/
- parray[p].num_formula = atoi(value);
-
- if (parray[p].num_formula > 0) {
+ if ((parray[p].num_formula = atoi(value)) >= MAX_FORMULA) {
+ warnx("%s: %s: too many formulas (%d)", __func__, file,
+ parray[p].num_formula);
+ return -1;
+ } else if (parray[p].num_formula > 0) {
for (i = 0; i < parray[p].num_formula; i++) {
if (fgets(tmp, sizeof tmp, fp) == NULL) {
warnx("%s: bad formula: feof %s",
@@ -884,6 +918,8 @@ got_attr_value_player(int p, char *attr, char *value, FILE *fp, char *file)
xstrdup(tmp) : NULL);
}
}
+ } else {
+ /* null */;
}
} else if (!strcmp(attr, "formula:")) {
/*
@@ -896,9 +932,11 @@ got_attr_value_player(int p, char *attr, char *value, FILE *fp, char *file)
* num_alias
*/
- parray[p].numAlias = atoi(value);
-
- if (parray[p].numAlias > 0) {
+ if ((parray[p].numAlias = atoi(value)) >= MAX_ALIASES) {
+ warnx("%s: %s: too many aliases (%d)", __func__, file,
+ parray[p].numAlias);
+ return -1;
+ } else if (parray[p].numAlias > 0) {
for (i = 0; i < parray[p].numAlias; i++) {
if (fgets(tmp, sizeof tmp, fp) == NULL) {
warnx("%s: bad alias: feof %s",
@@ -906,7 +944,7 @@ got_attr_value_player(int p, char *attr, char *value, FILE *fp, char *file)
return -1;
}
- if (!(len = strlen(tmp))) {
+ if (!strlen(tmp)) { // XXX
fprintf(stderr, "FICS: Error bad alias "
"in file %s\n", file);
i--;
@@ -925,13 +963,21 @@ got_attr_value_player(int p, char *attr, char *value, FILE *fp, char *file)
xstrdup(tmp1);
}
}
+ } else {
+ /* null */;
}
} else if (!strcmp(attr, "num_censor:")) {
/*
* num_censor
*/
- i = atoi(value);
+ if ((i = atoi(value)) < 0) {
+ warnx("%s: num censor negative", __func__);
+ return -1;
+ } else if (i > MAX_CENSOR) {
+ warnx("%s: num censor too large", __func__);
+ return -1;
+ }
while (i--) {
if (fgets(tmp, sizeof tmp, fp) == NULL) {
@@ -950,7 +996,13 @@ got_attr_value_player(int p, char *attr, char *value, FILE *fp, char *file)
}
}
} else if (!strcmp(attr, "num_notify:")) {
- i = atoi(value);
+ if ((i = atoi(value)) < 0) {
+ warnx("%s: num notify negative", __func__);
+ return -1;
+ } else if (i > MAX_NOTIFY) {
+ warnx("%s: num notify too large", __func__);
+ return -1;
+ }
while (i--) {
if (fgets(tmp, sizeof tmp, fp) == NULL) {
@@ -969,7 +1021,10 @@ got_attr_value_player(int p, char *attr, char *value, FILE *fp, char *file)
}
}
} else if (!strcmp(attr, "num_noplay:")) {
- i = atoi(value);
+ if ((i = atoi(value)) < 0) {
+ warnx("%s: num noplay negative", __func__);
+ return -1;
+ }
while (i--) {
if (fgets(tmp, sizeof tmp, fp) == NULL) {
@@ -988,7 +1043,10 @@ got_attr_value_player(int p, char *attr, char *value, FILE *fp, char *file)
}
}
} else if (!strcmp(attr, "num_gnotify:")) {
- i = atoi(value);
+ if ((i = atoi(value)) < 0) {
+ warnx("%s: num gnotify negative", __func__);
+ return -1;
+ }
while (i--) {
if (fgets(tmp, sizeof tmp, fp) == NULL) {
@@ -1806,10 +1864,10 @@ player_remove_pendto(int p, int p1, int type)
removed = true;
}
- if (removed)
- parray[p].num_to -= 1;
+ UNUSED_VAR(removed);
+ parray[p].num_to -= 1;
- return (removed ? 0 : -1);
+ return (0);
}
PUBLIC int
@@ -1869,10 +1927,10 @@ player_remove_pendfrom(int p, int p1, int type)
removed = true;
}
- if (removed)
- parray[p].num_from -= 1;
+ UNUSED_VAR(removed);
+ parray[p].num_from -= 1;
- return (removed ? 0 : -1);
+ return (0);
}
PUBLIC int
@@ -1907,28 +1965,44 @@ player_add_request(int p, int p1, int type, int param)
PUBLIC int
player_remove_request(int p, int p1, int type)
{
- int to = 0, from = 0;
+ bool removed;
+ int to = 0, from = 0;
+
+ while (to != -1 && (to = player_find_pendto(p, p1, type)) != -1) {
+ removed = false;
- while (to != -1) {
- if ((to = player_find_pendto(p, p1, type)) != -1) {
- for (; to < parray[p].num_to - 1; to++) {
- parray[p].p_to_list[to] =
- parray[p].p_to_list[to + 1];
+ for (; to < parray[p].num_to - 1; to++) {
+ if (to + 1 >= (int)ARRAY_SIZE(parray[0].p_to_list)) {
+ warnx("%s: overflowed array index read/write",
+ __func__);
+ break;
}
- parray[p].num_to = (parray[p].num_to - 1);
+ parray[p].p_to_list[to] = parray[p].p_to_list[to + 1];
+ removed = true;
}
+
+ UNUSED_VAR(removed);
+ parray[p].num_to -= 1;
}
- while (from != -1) {
- if ((from = player_find_pendfrom(p1, p, type)) != -1) {
- for (; from < parray[p1].num_from - 1; from++) {
- parray[p1].p_from_list[from] =
- parray[p1].p_from_list[from + 1];
+ while (from != -1 && (from = player_find_pendfrom(p1, p, type)) != -1) {
+ removed = false;
+
+ for (; from < parray[p1].num_from - 1; from++) {
+ if (from + 1 >= (int)ARRAY_SIZE(parray[0].p_from_list)) {
+ warnx("%s: overflowed array index read/write",
+ __func__);
+ break;
}
- parray[p1].num_from = (parray[p1].num_from - 1);
+ parray[p1].p_from_list[from] =
+ parray[p1].p_from_list[from + 1];
+ removed = true;
}
+
+ UNUSED_VAR(removed);
+ parray[p1].num_from -= 1;
}
if ((type == PEND_ALL || type == PEND_MATCH) && parray[p].partner >= 0)
@@ -2296,7 +2370,6 @@ player_goto_next_board(int p)
on = parray[p].simul_info.onBoard;
start = on;
- g = -1;
do {
on++;
@@ -2325,7 +2398,6 @@ player_goto_prev_board(int p)
on = parray[p].simul_info.onBoard;
start = on;
- g = -1;
do {
--on;
@@ -2764,7 +2836,7 @@ player_show_messages(int p)
PUBLIC int
ShowMsgsBySender(int p, param_list param)
{
- int nFrom, nTo;
+ int nFrom = -1, nTo = -1;
int p1, connected;
textlist *Head;
@@ -2777,8 +2849,6 @@ ShowMsgsBySender(int p, param_list param)
return -1; /* no need to disconnect */
}
- nFrom = nTo = -1;
-
if (p != p1) {
if ((nTo = LoadMsgs(p1, p + 1, &Head)) <= 0) {
pprintf(p, "%s has no messages from you.\n",
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-28 19:51:44 +0000