6 files changed, 42 insertions, 26 deletions
diff --git a/src/common/lock.c b/src/common/lock.c
index 5cb4c3a67..643b86e5c 100644
--- a/src/common/lock.c
+++ b/src/common/lock.c
@@ -1,8 +1,9 @@
 // Copyright (c) Athena Dev Teams - Licensed under GNU GPL
 // For more information, see LICENCE in the main folder
 
-#include "../common/cbasetypes.h"
-#include "../common/showmsg.h"
+#include "cbasetypes.h"
+#include "showmsg.h"
+#include "utils.h"
 #include "lock.h"
 
 #include <stdio.h>
@@ -12,12 +13,8 @@
 #include <unistd.h>
 #else
 #include <io.h>
-#define F_OK   0x0
-#define R_OK   0x4
 #endif
 
-#define exists(filename) (!access(filename, F_OK))
-
 // 書き込みファイルの保護処理
 // （書き込みが終わるまで、旧ファイルを保管しておく）
 
diff --git a/src/common/mmo.h b/src/common/mmo.h
index 6a78d840c..92adf8af0 100644
--- a/src/common/mmo.h
+++ b/src/common/mmo.h
@@ -108,13 +108,6 @@
 #define MAX_QUEST_DB 2000 //Max quests that the server will load
 #define MAX_QUEST_OBJECTIVES 3 //Max quest objectives for a quest
 
-#define MIN_HAIR_STYLE battle_config.min_hair_style
-#define MAX_HAIR_STYLE battle_config.max_hair_style
-#define MIN_HAIR_COLOR battle_config.min_hair_color
-#define MAX_HAIR_COLOR battle_config.max_hair_color
-#define MIN_CLOTH_COLOR battle_config.min_cloth_color
-#define MAX_CLOTH_COLOR battle_config.max_cloth_color
-
 // for produce
 #define MIN_ATTRIBUTE 0
 #define MAX_ATTRIBUTE 4
@@ -147,6 +140,10 @@
 #define END_ACCOUNT_NUM 100000000
 #define START_CHAR_NUM 150000
 
+//Guilds
+#define MAX_GUILDMES1 60
+#define MAX_GUILDMES2 120
+
 //Base Homun skill.
 #define HM_SKILLBASE 8001
 #define MAX_HOMUNSKILL 16
@@ -177,6 +174,7 @@ enum item_types {
 	IT_UNKNOWN2,//9
 	IT_AMMO,    //10
 	IT_DELAYCONSUME,//11
+	IT_CASH = 18,
 	IT_MAX 
 };
 
@@ -240,7 +238,7 @@ struct guild_storage {
 	int guild_id;
 	short storage_status;
 	short storage_amount;
-	struct item storage_[MAX_GUILD_STORAGE];
+	struct item items[MAX_GUILD_STORAGE];
 };
 
 struct s_pet {
@@ -474,7 +472,7 @@ struct guild {
 	char name[NAME_LENGTH],master[NAME_LENGTH];
 	struct guild_member member[MAX_GUILD];
 	struct guild_position position[MAX_GUILDPOSITION];
-	char mes1[60],mes2[120];
+	char mes1[MAX_GUILDMES1],mes2[MAX_GUILDMES2];
 	int emblem_len,emblem_id;
 	char emblem_data[2048];
 	struct guild_alliance alliance[MAX_GUILDALLIANCE];
diff --git a/src/common/socket.c b/src/common/socket.c
index deba0e97b..89c605c9d 100644
--- a/src/common/socket.c
+++ b/src/common/socket.c
@@ -199,6 +199,10 @@ time_t stall_time = 60;
 uint32 addr_[16];   // ip addresses of local host (host byte order)
 int naddr_ = 0;   // # of ip addresses
 
+// Maximum packet size in bytes, which the client is able to handle.
+// Larger packets cause a buffer overflow and stack corruption.
+static size_t socket_max_client_packet = 20480;
+
 // initial recv buffer size (this will also be the max. size)
 // biggest known packet: S 0153 <len>.w <emblem data>.?B -> 24x24 256 color .bmp (0153 + len.w + 1618/1654/1756 bytes)
 #define RFIFO_SIZE (2*1024)
@@ -643,8 +647,15 @@ int WFIFOSET(int fd, size_t len)
 		exit(EXIT_FAILURE);
 	}
 
+	if( !s->flag.server && len > socket_max_client_packet )
+	{// see declaration of socket_max_client_packet for details
+		ShowError("WFIFOSET: Dropped too large client packet 0x%04x (length=%u, max=%u).\n", WFIFOW(fd,0), len, socket_max_client_packet);
+		return 0;
+	}
+
 	if( !s->flag.server && s->wdata_size+len > WFIFO_MAX )
 	{// reached maximum write fifo size
+		ShowError("WFIFOSET: Maximum write buffer size for client connection %d exceeded, most likely caused by packet 0x%04x (len=%u, ip=%lu.%lu.%lu.%lu).\n", fd, WFIFOW(fd,0), len, CONVIP(s->client_addr));
 		set_eof(fd);
 		return 0;
 	}
@@ -1064,6 +1075,8 @@ int socket_config_read(const char* cfgName)
 			ddos_autoreset = atoi(w2);
 		else if (!strcmpi(w1,"debug"))
 			access_debug = config_switch(w2);
+		else if (!strcmpi(w1,"socket_max_client_packet"))
+			socket_max_client_packet = strtoul(w2, NULL, 0);
 #endif
 		else if (!strcmpi(w1, "import"))
 			socket_config_read(w2);
diff --git a/src/common/strlib.c b/src/common/strlib.c
index 7a6c134e7..019e2d629 100644
--- a/src/common/strlib.c
+++ b/src/common/strlib.c
@@ -12,7 +12,6 @@
 #include <errno.h>
 
 
-
 #define J_MAX_MALLOC_SIZE 65535
 
 // escapes a string in-place (' -> \' , \ -> \\ , % -> _)
@@ -657,7 +656,7 @@ int sv_split(char* str, int len, int startoff, char delim, char** out_fields, in
 			end[0] = end[1] = '\0';
 		*out_fields = end + 2;
 	}
-	else if( (opt&SV_TERMINATE_LF) && end[0] == '\r' )
+	else if( (opt&SV_TERMINATE_CR) && end[0] == '\r' )
 	{
 		if( !(opt&SV_KEEP_TERMINATOR) )
 			end[0] = '\0';
@@ -923,18 +922,12 @@ bool sv_readdb(const char* directory, const char* filename, char delim, int minc
 	FILE* fp;
 	int lines = 0;
 	int entries = 0;
-	char* fields[64]; // room for 63 fields ([0] is reserved)
-	int columns;
+	char** fields; // buffer for fields ([0] is reserved)
+	int columns, fields_length;
 	char path[1024], line[1024];
 
 	snprintf(path, sizeof(path), "%s/%s", directory, filename);
 
-	if( maxcols > ARRAYLENGTH(fields)-1 )
-	{
-		ShowError("sv_readdb: Insufficient column storage in parser for file \"%s\" (want %d, have only %d). Increase the capacity in the source code please.\n", path, maxcols, ARRAYLENGTH(fields)-1);
-		return false;
-	}
-
 	// open file
 	fp = fopen(path, "r");
 	if( fp == NULL )
@@ -943,6 +936,10 @@ bool sv_readdb(const char* directory, const char* filename, char delim, int minc
 		return false;
 	}
 
+	// allocate enough memory for the maximum requested amount of columns plus the reserved one
+	fields_length = maxcols+1;
+	fields = aMalloc(fields_length*sizeof(char*));
+
 	// process rows one by one
 	while( fgets(line, sizeof(line), fp) )
 	{
@@ -954,7 +951,7 @@ bool sv_readdb(const char* directory, const char* filename, char delim, int minc
 		if( line[0] == '\0' || line[0] == '\n' || line[0] == '\r')
 			continue;
 
-		columns = sv_split(line, strlen(line), 0, delim, fields, ARRAYLENGTH(fields), (e_svopt)(SV_TERMINATE_LF|SV_TERMINATE_CRLF));
+		columns = sv_split(line, strlen(line), 0, delim, fields, fields_length, (e_svopt)(SV_TERMINATE_LF|SV_TERMINATE_CRLF));
 
 		if( columns < mincols )
 		{
@@ -983,6 +980,7 @@ bool sv_readdb(const char* directory, const char* filename, char delim, int minc
 		entries++;
 	}
 
+	aFree(fields);
 	fclose(fp);
 	ShowStatus("Done reading '"CL_WHITE"%d"CL_RESET"' entries in '"CL_WHITE"%s"CL_RESET"'.\n", entries, path);
 
diff --git a/src/common/utils.c b/src/common/utils.c
index c1128edb4..12123784f 100644
--- a/src/common/utils.c
+++ b/src/common/utils.c
@@ -14,7 +14,11 @@
 #include <math.h> // floor()
 
 #ifdef WIN32
+	#include <io.h>
 	#include <windows.h>
+	#ifndef F_OK
+		#define F_OK   0x0
+	#endif  /* F_OK */
 #else
 	#include <unistd.h>
 	#include <dirent.h>
@@ -182,6 +186,11 @@ void findfile(const char *p, const char *pat, void (func)(const char*))
 }
 #endif
 
+bool exists(const char* filename)
+{
+	return !access(filename, F_OK);
+}
+
 uint8 GetByte(uint32 val, int idx)
 {
 	switch( idx )
diff --git a/src/common/utils.h b/src/common/utils.h
index 93563dc34..5cf3ff3cf 100644
--- a/src/common/utils.h
+++ b/src/common/utils.h
@@ -14,6 +14,7 @@
 void dump(FILE* fp, const unsigned char* buffer, int length);
 
 void findfile(const char *p, const char *pat, void (func)(const char*));
+bool exists(const char* filename);
 
 //Caps values to min/max
 #define cap_value(a, min, max) ((a >= max) ? max : (a <= min) ? min : a)