Re: Wiz Command Problem

From: Zeavon (zeavon@kilnar.com)
Date: 03/06/00


On Mon, 6 Mar 2000, Deja Augustine wrote:

> > You're pushing stuff into a buffer with a limited size and not checking to
> >  see if there is room left in the buffer for the information. I'm willing
> >  to bet dimes to dollars that the problem is a buffer overflow.
> >
> >  Check to make sure that there is room in your buffer for what you're about
> >  to shove in there.
>
> How (i.e. what variable) do I check to see how much room is in the buffer?
>

Here's some mailer pseudocode that should tell you how to handle this.
This will not compile (it's pseudocode after all) but it will give you an
idea on what to do.


char tmp[MAX_STRING_LENGTH];
char buf[MAX_STRING_LENGTH];

*buf = '\0';
*tmp = '\0';

while (looking for stuff) {
  sprintf(tmp, "stuff stuff stuff %d %d %d", num1, num2, num3");

  // THIS IS THE LINE THAT CHECKS BUFFER SIZES
  if (strlen(tmp) + strlen(buf) >= MAX_STRING_LENGTH) {
    log("SYSERR: Buffer overflow in FUNCTION NAME");
    send_to_char("buffer overflow\r\n, ch);
    break;
  }
  else
    strcat(buf, tmp);

  page_string(ch->desc, buf, TRUE);
}

--
Zeavon Calatin, MageMaster of the Realms
Spear of Insanity
http://spear.kilnar.com/    telnet://spear.kilnar.com:1066


     +------------------------------------------------------------+
     | Ensure that you have read the CircleMUD Mailing List FAQ:  |
     |  http://qsilver.queensu.ca/~fletchra/Circle/list-faq.html  |
     +------------------------------------------------------------+



This archive was generated by hypermail 2b30 : 04/10/01 PDT