Mercurial > hg > early-roguelike

comparison srogue/main.c @ 176:db1c9a21a7c3

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
srogue: prevent overflowing the score file name. If SCOREFILE is not defined, roguehome() is called to find a directory for the score file. It copies up to PATH_MAX-20 bytes from an environment variable to a static buffer. Later these are strcpy()'d to scorefile, which is of size LINLEN. Unfortunately LINLEN is 80 and PATH_MAX is at least 256. On Linux, it happens to be 4096. I haven't yet managed to crash or exploit it, but there are surely no beneficial consequences, so roguehome() has been modified to check the length, and the string it returns is also checked in main().
author John "Elwin" Edwards
date Sun, 02 Aug 2015 12:14:47 -0400
parents 1863409c44cf
children 7c552cbc6ad9
comparison
equal deleted inserted replaced
175:10c273a62228 176:db1c9a21a7c3
67 #ifdef SCOREFILE 67 #ifdef SCOREFILE
68 strncpy(scorefile, SCOREFILE, LINLEN); 68 strncpy(scorefile, SCOREFILE, LINLEN);
69 scorefile[LINLEN - 1] = '\0'; 69 scorefile[LINLEN - 1] = '\0';
70 #else 70 #else
71 71
72 strcpy(scorefile, homedir); 72 strncpy(scorefile, homedir, LINLEN-11);
73 if (scorefile[LINLEN-12] != '\0')
74 scorefile[0] = '\0';
73 75
74 if (*scorefile) 76 if (*scorefile)
75 strcat(scorefile,"/"); 77 strcat(scorefile,"/");
76 strcat(scorefile, "srogue.scr"); 78 strcat(scorefile, "srogue.scr");
77 #endif 79 #endif
442 } 444 }
443 445
444 char * 446 char *
445 roguehome() 447 roguehome()
446 { 448 {
447 static char path[1024]; 449 static char path[LINLEN+16];
448 char *end,*home; 450 char *end,*home;
449 451
450 if ( (home = getenv("ROGUEHOME")) != NULL) 452 if ( (home = getenv("ROGUEHOME")) != NULL)
451 { 453 {
452 if (*home) 454 if (*home)
453 { 455 {
454 strncpy(path, home, PATH_MAX - 20); 456 /* LINLEN - 11 is all that will fit into scorefile */
455 457 strncpy(path, home, LINLEN - 11);
456 end = &path[strlen(path)-1]; 458 if (path[LINLEN - 12] == '\0')
457 459 {
458 460 end = &path[strlen(path)-1];
459 while( (end >= path) && ((*end == '/') || (*end == '\\'))) 461 while( (end >= path) && ((*end == '/') || (*end == '\\')))
460 *end-- = '\0'; 462 *end-- = '\0';
461 463
462 if (directory_exists(path)) 464 if (directory_exists(path))
463 return(path); 465 return(path);
466 }
467 /* Otherwise home was truncated and should be ignored */
464 } 468 }
465 } 469 }
466 470
467 if (directory_exists("/var/games/roguelike")) 471 if (directory_exists("/var/games/roguelike"))
468 return("/var/games/roguelike"); 472 return("/var/games/roguelike");