- looks outdated

[packages/Canna.git] / Canna-multivul.patch

diff -ruN Canna35b2.orig/server/convert.c Canna35b2/server/convert.c
--- Canna35b2.orig/server/convert.c	Mon Dec  2 20:01:34 1996
+++ Canna35b2/server/convert.c	Mon Nov 11 19:59:52 2002
@@ -53,6 +53,8 @@
 #define ACK2 2
 #define ACK3 3
 #define CHECK_ACK_BUF_SIZE	(ACK_BUFSIZE + (SIZEOFLONG * 2) )
+#define IR_INT_MAX 32767
+#define IR_INT_INVAL(x) ((unsigned int)x > IR_INT_MAX)
 
 extern int  errno;
 
@@ -1778,6 +1780,8 @@
 	return( needsize ) ;
 
     req->namelen = (int)L4TOL(buf + SIZE4);
+    if( IR_INT_INVAL(req->namelen) )
+	return( -1 );
    ir_debug( Dmsg(10,"req->namelen =%d\n", req->namelen ); )
 
     if( (needsize = SIZE8 + req->namelen - size) > 0 )
@@ -1785,6 +1789,8 @@
 
     if( req->namelen > 0 ){
 	req->name = buf + SIZE8 ;
+	if( req->name[req->namelen - 1] != 0 )
+	    return( -1 );
     }
    ir_debug( Dmsg(10,"req->namelen =%d\n", req->namelen ); )
    ir_debug( Dmsg(10,"req->name =%s\n", req->name ); )
diff -ruN Canna35b2.orig/server/util.c Canna35b2/server/util.c
--- Canna35b2.orig/server/util.c	Wed Nov  6 19:09:47 1996
+++ Canna35b2/server/util.c	Mon Nov 11 19:59:52 2002
@@ -217,6 +217,19 @@
   return res;
 }
 
+const Ushort *
+ushortmemchr(ws, ch, len)
+const Ushort *ws;
+int ch;
+size_t len;
+{
+  const Ushort *p, *end;
+  for (p = ws, end = ws + len; p < end; ++p)
+      if (*p == (Ushort)ch)
+	  return p;
+  return NULL;
+}
+
 int
 ushortstrcpy(wd, ws)
 Ushort *wd, *ws;
diff -ruN Canna35b2.orig/server/wconvert.c Canna35b2/server/wconvert.c
--- Canna35b2.orig/server/wconvert.c	Mon Nov 11 19:42:07 2002
+++ Canna35b2/server/wconvert.c	Mon Nov 11 19:59:52 2002
@@ -100,6 +100,7 @@
 #endif
 
 extern void DispDebug() ;
+extern const Ushort *ushortmemchr pro((const Ushort *, int, size_t));
 extern int canna_server_hi ;
 extern int canna_server_lo ;
 #ifdef DEBUG
@@ -1322,7 +1323,10 @@
     char *dirname, *dirnamelong = (char *)0;
     int cxnum = Request.type18.context, stat = -1;
     int requestsize = Request.type18.size, retval;
+    size_t datasize = Request.type18.datalen - SIZEOFSHORT * 2;
 
+    if (datasize == 0 || req->data[datasize - 1] != 0)
+      goto protoerr;
     if (validcontext(cxnum, client, wListDictionary)) {
       if (requestsize <= sizeof(local_buffer) ||
 	  (dicnames = malloc(requestsize))) {
@@ -1359,6 +1363,7 @@
       }
     }	
 
+protoerr:
     retval = SendType6Reply(client, wListDictionary, EXTPROTO, stat,
 			    dicnames, namesize(dicnames, stat));
     if (dicnames != (char *)local_buffer) free(dicnames);
@@ -1470,10 +1475,15 @@
     char *dicname, *dirname, *dirnamelong = (char *)0;
     int cxnum = Request.type18.context, stat = BADCONT;
     int dirlen, requestsize = Request.type18.size, retval;
+    size_t datasize = Request.type18.datalen - SIZEOFSHORT * 2;
 
+    if (datasize == 0 || req->data[datasize - 1] != 0)
+      goto protoerr;
     if (validcontext(cxnum, client, wGetWordTextDictionary)) {
 	dirname = req->data ;
 	dirlen = strlen(dirname) + 1 ;
+	if (dirlen == datasize)
+	  goto protoerr;
 	dicname = &(req->data[dirlen]) ;
 	if (dirlen > 1) {
 	  if (!dirname || dirname[0] != ':' ||
@@ -1515,6 +1525,7 @@
 	  free(dirnamelong);
 	}
     }
+protoerr:
     retval = SendType7Reply(client, wGetWordTextDictionary, EXTPROTO,
 			    stat, stat > 0 ? stat + 1 : 0, infobuf);
     if (infobuf != (Ushort *)local_buffer) free((char *)infobuf);
@@ -2296,6 +2307,9 @@
 {
     ir_debug( Dmsg(10, "ProcWideReq1 start!!\n") );
 
+    if (Request.type1.datalen != 0)
+	return( -1 );
+
     return( 0 ) ;
 }
 
@@ -2305,6 +2319,8 @@
 {
     ir_debug( Dmsg(10, "ProcWideReq2 start!!\n") );
 
+    if (Request.type2.datalen != SIZEOFSHORT)
+	return( -1 );
     buf += HEADER_SIZE; Request.type2.context = S2TOS(buf);
     ir_debug( Dmsg(10, "req->context =%d\n", Request.type2.context) );
 
@@ -2317,6 +2333,8 @@
 {
     ir_debug( Dmsg(10, "ProcWideReq3 start!!\n") );
 
+    if (Request.type3.datalen != SIZEOFSHORT * 2)
+	return( -1 );
     buf += HEADER_SIZE; Request.type3.context = S2TOS(buf);
     buf += SIZEOFSHORT; Request.type3.buflen = S2TOS(buf);
     ir_debug( Dmsg(10, "req->context =%d\n", Request.type3.context) );
@@ -2334,12 +2352,18 @@
 
     ir_debug( Dmsg(10, "ProcWideReq4 start!!\n") );
 
+    if (Request.type4.datalen < SIZEOFSHORT * 4)
+	return( -1 );
     buf += HEADER_SIZE; Request.type4.context = S2TOS(buf);
     buf += SIZEOFSHORT; Request.type4.begin = S2TOS(buf);
     buf += SIZEOFSHORT; Request.type4.end = S2TOS(buf);
     buf += SIZEOFSHORT; Request.type4.yomilen = S2TOS(buf);
     Request.type4.yomi = (Ushort *)(buf += SIZEOFSHORT) ;
-    len = Request.type4.datalen - SIZEOFSHORT * 4;
+    len = Request.type4.yomilen + 1;
+    if (Request.type4.datalen != SIZEOFSHORT * (4 + len)
+	    || len == 0
+	    || Request.type4.yomi[len - 1] != 0)
+	return( -1 );
     for (data = Request.type4.yomi, i = 0; i < len; i++, data++)