From f87f36b82dbf7f907555fed2fdd8efab8f869ea6 Mon Sep 17 00:00:00 2001 From: ai4rei Date: Sun, 16 Oct 2011 06:26:40 +0000 Subject: * Fixed public/guild chat message packets sending strings without zero-termination causing recent clients to display trailing junk on such messages (bugreport:5068). - Changed memcpy to safestrncpy in message packets where overlong messages are truncated (thus loose zero-termination). - Replaced dynamic allocation in clif_guild_message with buffer from stack. - Fixed clif_disp_message not checking whether the message fits into provided buffer. git-svn-id: https://rathena.svn.sourceforge.net/svnroot/rathena/trunk@14975 54d463be-8e91-2dee-dedb-b68131a5f0ec --- src/map/clif.c | 88 ++++++++++++++++++++++++++++++---------------------------- 1 file changed, 45 insertions(+), 43 deletions(-) (limited to 'src/map/clif.c') diff --git a/src/map/clif.c b/src/map/clif.c index e83db8d4f..7b2a97006 100644 --- a/src/map/clif.c +++ b/src/map/clif.c @@ -5028,7 +5028,7 @@ void clif_GlobalMessage(struct block_list* bl, const char* message) WBUFW(buf,0)=0x8d; WBUFW(buf,2)=len+8; WBUFL(buf,4)=bl->id; - strncpy((char *) WBUFP(buf,8),message,len); + safestrncpy((char *) WBUFP(buf,8),message,len); clif_send((unsigned char *) buf,WBUFW(buf,2),bl,ALL_CLIENT); } @@ -5037,7 +5037,7 @@ void clif_GlobalMessage(struct block_list* bl, const char* message) *------------------------------------------*/ void clif_MainChatMessage(const char* message) { - char buf[200]; + uint8 buf[200]; int len; if(!message) @@ -5051,8 +5051,8 @@ void clif_MainChatMessage(const char* message) WBUFW(buf,0)=0x8d; WBUFW(buf,2)=len+8; WBUFL(buf,4)=0; - strncpy((char *) WBUFP(buf,8),message,len); - clif_send((unsigned char *) buf,WBUFW(buf,2),NULL,CHAT_MAINCHAT); + safestrncpy((char *) WBUFP(buf,8),message,len); + clif_send(buf,WBUFW(buf,2),NULL,CHAT_MAINCHAT); } /*========================================== @@ -7147,27 +7147,33 @@ void clif_guild_expulsionlist(struct map_session_data* sd) WFIFOSET(fd,WFIFOW(fd,2)); } -/*========================================== - * ギルド会話 - *------------------------------------------*/ -int clif_guild_message(struct guild *g,int account_id,const char *mes,int len) -{ + +/// Notification of a guild chat message (ZC_GUILD_CHAT) +/// 017f .W .?B +void clif_guild_message(struct guild *g,int account_id,const char *mes,int len) +{// TODO: account_id is not used, candidate for deletion? [Ai4rei] struct map_session_data *sd; - unsigned char *buf; + uint8 buf[256]; - buf = (unsigned char*)aMallocA((len + 4)*sizeof(unsigned char)); + if( len == 0 ) + { + return; + } + else if( len > sizeof(buf)-5 ) + { + ShowWarning("clif_guild_message: Truncated message '%s' (len=%d, max=%d, guild_id=%d).\n", mes, len, sizeof(buf)-5, g->guild_id); + len = sizeof(buf)-5; + } WBUFW(buf, 0) = 0x17f; - WBUFW(buf, 2) = len + 4; - memcpy(WBUFP(buf,4), mes, len); + WBUFW(buf, 2) = len + 5; + safestrncpy((char*)WBUFP(buf,4), mes, len+1); if ((sd = guild_getavailablesd(g)) != NULL) clif_send(buf, WBUFW(buf,2), &sd->bl, GUILD_NOBG); +} - if(buf) aFree(buf); - return 0; -} /*========================================== * ギルドスキル割り振り通知 *------------------------------------------*/ @@ -7409,18 +7415,9 @@ void clif_parse_ReqMarriage(int fd, struct map_session_data *sd) /*========================================== * *------------------------------------------*/ -int clif_disp_onlyself(struct map_session_data *sd, const char *mes, int len) +void clif_disp_onlyself(struct map_session_data *sd, const char *mes, int len) { - int fd; - nullpo_ret(sd); - fd = sd->fd; - if (!fd || !len) return 0; //Disconnected player. - WFIFOHEAD(fd, len+5); - WFIFOW(fd, 0) = 0x17f; - WFIFOW(fd, 2) = len + 5; - memcpy(WFIFOP(fd,4), mes, len); - WFIFOSET(fd, WFIFOW(fd,2)); - return 1; + clif_disp_message(&sd->bl, mes, len, SELF); } /*========================================== @@ -7428,13 +7425,22 @@ int clif_disp_onlyself(struct map_session_data *sd, const char *mes, int len) *------------------------------------------*/ void clif_disp_message(struct block_list* src, const char* mes, int len, enum send_target target) { - unsigned char buf[1024]; - if (!len) return; + unsigned char buf[256]; + + if( len == 0 ) + { + return; + } + else if( len > sizeof(buf)-5 ) + { + ShowWarning("clif_disp_message: Truncated message '%s' (len=%d, max=%d, aid=%d).\n", mes, len, sizeof(buf)-5, src->id); + len = sizeof(buf)-5; + } + WBUFW(buf, 0) = 0x17f; WBUFW(buf, 2) = len + 5; - memcpy(WBUFP(buf,4), mes, len); + safestrncpy((char*)WBUFP(buf,4), mes, len+1); clif_send(buf, WBUFW(buf,2), src, target); - return; } /*========================================== @@ -7657,12 +7663,12 @@ int clif_messagecolor(struct block_list* bl, unsigned long color, const char* ms } // messages (from mobs/npcs) [Valaris] -int clif_message(struct block_list* bl, const char* msg) +void clif_message(struct block_list* bl, const char* msg) { unsigned short msg_len = strlen(msg) + 1; uint8 buf[256]; - nullpo_ret(bl); + nullpo_retv(bl); if( msg_len > sizeof(buf)-8 ) { @@ -7673,11 +7679,9 @@ int clif_message(struct block_list* bl, const char* msg) WBUFW(buf,0) = 0x8d; WBUFW(buf,2) = msg_len + 8; WBUFL(buf,4) = bl->id; - memcpy(WBUFP(buf,8), msg, msg_len); + safestrncpy((char*)WBUFP(buf,8), msg, msg_len); clif_send(buf, WBUFW(buf,2), bl, AREA_CHAT_WOC); - - return 0; } // refresh the client's screen, getting rid of any effects @@ -7951,29 +7955,27 @@ void clif_slide(struct block_list *bl, int x, int y) /*------------------------------------------ * @me command by lordalfa, rewritten implementation by Skotlex *------------------------------------------*/ -int clif_disp_overhead(struct map_session_data *sd, const char* mes) +void clif_disp_overhead(struct map_session_data *sd, const char* mes) { unsigned char buf[256]; //This should be more than sufficient, the theorical max is CHAT_SIZE + 8 (pads and extra inserted crap) int len_mes = strlen(mes)+1; //Account for \0 - if (len_mes + 8 >= 256) { + if (len_mes > sizeof(buf)-8) { ShowError("clif_disp_overhead: Message too long (length %d)\n", len_mes); - len_mes = 247; //Trunk it to avoid problems. + len_mes = sizeof(buf)-8; //Trunk it to avoid problems. } // send message to others WBUFW(buf,0) = 0x8d; WBUFW(buf,2) = len_mes + 8; // len of message + 8 (command+len+id) WBUFL(buf,4) = sd->bl.id; - memcpy(WBUFP(buf,8), mes, len_mes); + safestrncpy((char*)WBUFP(buf,8), mes, len_mes); clif_send(buf, WBUFW(buf,2), &sd->bl, AREA_CHAT_WOC); // send back message to the speaker WBUFW(buf,0) = 0x8e; WBUFW(buf, 2) = len_mes + 4; - memcpy(WBUFP(buf,4), mes, len_mes); + safestrncpy((char*)WBUFP(buf,4), mes, len_mes); clif_send(buf, WBUFW(buf,2), &sd->bl, SELF); - - return 0; } /*========================== -- cgit v1.2.3-70-g09d2