adam/znc
1
0
Fork 0
mirror of https://github.com/znc/znc.git synced 2026-07-06 01:41:12 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix an dangerous substr() call

Browse Source 
A malicious IRCd could send a WHO reply for a nick which consisted completely
out of prefix characters (thus an empty nick). In this case
std::string::find_first_of() would return std::string::npos. This argument would
make std::string::substr() throw an exception and kill the process.

Signed-off-by: Uli Schlachter <psychon@znc.in>
This commit is contained in:
Uli Schlachter
2012-03-30 23:13:03 +02:00
parent 95053f4db4
commit d5b84f50db
1 changed files with 8 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/IRCSock.cpp
+8 -4
View File
@@ -330,10 +330,14 @@ void CIRCSock::ReadLine(const CString& sData) {
// The client doesn't support multi-prefix so we need to remove
// the other prefixes.
CString sNewLine = sServer + " 352 " + sLine.Token(2) + " " + \
sLine.Token(3) + " " + sIdent + " " + sHost + " " + \
sLine.Token(6) + " " + sNick[0] + \
sNick.substr(sNick.find_first_not_of(GetPerms())) + " " + \
CString sNewNick = sNick;
size_t pos = sNick.find_first_not_of(GetPerms());
if (pos >= 2 && pos != CString::npos) {
sNewNick = sNick[0] + sNick.substr(pos);
}
CString sNewLine = sServer + " 352 " + sLine.Token(2) + " " +
sLine.Token(3) + " " + sIdent + " " + sHost + " " +
sLine.Token(6) + " " + sNewNick + " " +
sLine.Token(8, true);
m_pNetwork->PutUser(sNewLine, pClient);
}