From d5b84f50db49a572ed9e3ca15a472922c7d70930 Mon Sep 17 00:00:00 2001 From: Uli Schlachter Date: Fri, 30 Mar 2012 23:13:03 +0200 Subject: [PATCH 1/2] Fix an dangerous substr() call A malicious IRCd could send a WHO reply for a nick which consisted completely out of prefix characters (thus an empty nick). In this case std::string::find_first_of() would return std::string::npos. This argument would make std::string::substr() throw an exception and kill the process. Signed-off-by: Uli Schlachter --- src/IRCSock.cpp | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/src/IRCSock.cpp b/src/IRCSock.cpp index 7d6b2f41..e5f988e9 100644 --- a/src/IRCSock.cpp +++ b/src/IRCSock.cpp @@ -330,10 +330,14 @@ void CIRCSock::ReadLine(const CString& sData) { // The client doesn't support multi-prefix so we need to remove // the other prefixes. - CString sNewLine = sServer + " 352 " + sLine.Token(2) + " " + \ - sLine.Token(3) + " " + sIdent + " " + sHost + " " + \ - sLine.Token(6) + " " + sNick[0] + \ - sNick.substr(sNick.find_first_not_of(GetPerms())) + " " + \ + CString sNewNick = sNick; + size_t pos = sNick.find_first_not_of(GetPerms()); + if (pos >= 2 && pos != CString::npos) { + sNewNick = sNick[0] + sNick.substr(pos); + } + CString sNewLine = sServer + " 352 " + sLine.Token(2) + " " + + sLine.Token(3) + " " + sIdent + " " + sHost + " " + + sLine.Token(6) + " " + sNewNick + " " + sLine.Token(8, true); m_pNetwork->PutUser(sNewLine, pClient); } From ed5610f3635c6f44b5e6d6af86e37e72c2b0a84f Mon Sep 17 00:00:00 2001 From: Uli Schlachter Date: Fri, 30 Mar 2012 23:15:57 +0200 Subject: [PATCH 2/2] imapauth: Follow RFC more closely The IMAP RFC allows the server to announce its capabilities before replying to the LOGIN command. imapauth would misinterpret that as a failed login. The fix is to only handle lines which contain the tag ("AUTH") used for the login command. Thanks to rlpowell for reporting that imapauth doesn't work against imap.google.com and for testing the fix. Signed-off-by: Uli Schlachter --- modules/imapauth.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/imapauth.cpp b/modules/imapauth.cpp index a17e85fd..944e505a 100644 --- a/modules/imapauth.cpp +++ b/modules/imapauth.cpp @@ -134,7 +134,7 @@ void CIMAPSock::ReadLine(const CString& sLine) { } Write("AUTH LOGIN " + sUsername + " " + m_spAuth->GetPassword() + "\r\n"); - } else { + } else if (sLine.Left(5) == "AUTH ") { CUser* pUser = CZNC::Get().FindUser(m_spAuth->GetUsername()); if (pUser && sLine.Equals("AUTH OK", false, 7)) {