k-space
/
nyancat-server
10
0
Fork 0
Code Issues Pull Requests Packages Projects Activity

Fix a buffer overflow by getting rid of all strcpy() calls

This commit is contained in:
Frederic Cambus 2016-01-23 15:39:12 +01:00 committed by K Lange
parent c46d53dac6
commit e5a3a2a051
1 changed files with 36 additions and 37 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

73
src/nyancat.c
View File

@ -49,7 +49,7 @@
* WITH THE SOFTWARE. * WITH THE SOFTWARE.
*/ */
#define _XOPEN_SOURCE 500 #define _XOPEN_SOURCE 700
#define _DARWIN_C_SOURCE 1 #define _DARWIN_C_SOURCE 1
#define _BSD_SOURCE #define _BSD_SOURCE
#define _DEFAULT_SOURCE #define _DEFAULT_SOURCE
@ -348,8 +348,7 @@ void usage(char * argv[]) {
int main(int argc, char ** argv) { int main(int argc, char ** argv) {
/* The default terminal is ANSI */ char *term = NULL;
char term[1024] = {'a','n','s','i', 0};
unsigned int k; unsigned int k;
int ttype; int ttype;
uint32_t option = 0, done = 0, sb_mode = 0; uint32_t option = 0, done = 0, sb_mode = 0;
@ -486,7 +485,7 @@ int main(int argc, char ** argv) {
/* This was a response to the TTYPE command, meaning /* This was a response to the TTYPE command, meaning
* that this should be a terminal type */ * that this should be a terminal type */
alarm(2); alarm(2);
strcpy(term, (char *)&sb[2]); term = strndup((char *)&sb[2], sizeof(sb)-2);
done++; done++;
} }
else if (sb[0] == NAWS) { else if (sb[0] == NAWS) {
@ -563,10 +562,7 @@ int main(int argc, char ** argv) {
} else { } else {
/* We are running standalone, retrieve the /* We are running standalone, retrieve the
* terminal type from the environment. */ * terminal type from the environment. */
char * nterm = getenv("TERM"); term = getenv("TERM");
if (nterm) {
strcpy(term, nterm);
}
/* Also get the number of columns */ /* Also get the number of columns */
struct winsize w; struct winsize w;
@ -575,36 +571,39 @@ int main(int argc, char ** argv) {
terminal_height = w.ws_row; terminal_height = w.ws_row;
} }
/* Convert the entire terminal string to lower case */ /* Default ttype */
for (k = 0; k < strlen(term); ++k) { ttype = 2;
term[k] = tolower(term[k]);
}
/* Do our terminal detection */ if (term) {
if (strstr(term, "xterm")) { /* Convert the entire terminal string to lower case */
ttype = 1; /* 256-color, spaces */ for (k = 0; k < strlen(term); ++k) {
} else if (strstr(term, "toaru")) { term[k] = tolower(term[k]);
ttype = 1; /* emulates xterm */ }
} else if (strstr(term, "linux")) {
ttype = 3; /* Spaces and blink attribute */ /* Do our terminal detection */
} else if (strstr(term, "vtnt")) { if (strstr(term, "xterm")) {
ttype = 5; /* Extended ASCII fallback == Windows */ ttype = 1; /* 256-color, spaces */
} else if (strstr(term, "cygwin")) { } else if (strstr(term, "toaru")) {
ttype = 5; /* Extended ASCII fallback == Windows */ ttype = 1; /* emulates xterm */
} else if (strstr(term, "vt220")) { } else if (strstr(term, "linux")) {
ttype = 6; /* No color support */ ttype = 3; /* Spaces and blink attribute */
} else if (strstr(term, "fallback")) { } else if (strstr(term, "vtnt")) {
ttype = 4; /* Unicode fallback */ ttype = 5; /* Extended ASCII fallback == Windows */
} else if (strstr(term, "rxvt-256color")) { } else if (strstr(term, "cygwin")) {
ttype = 1; /* xterm 256-color compatible */ ttype = 5; /* Extended ASCII fallback == Windows */
} else if (strstr(term, "rxvt")) { } else if (strstr(term, "vt220")) {
ttype = 3; /* Accepts LINUX mode */ ttype = 6; /* No color support */
} else if (strstr(term, "vt100") && terminal_width == 40) { } else if (strstr(term, "fallback")) {
ttype = 7; /* No color support, only 40 columns */ ttype = 4; /* Unicode fallback */
} else if (!strncmp(term, "st", 2)) { } else if (strstr(term, "rxvt-256color")) {
ttype = 1; /* suckless simple terminal is xterm-256color-compatible */ ttype = 1; /* xterm 256-color compatible */
} else { } else if (strstr(term, "rxvt")) {
ttype = 2; /* Everything else */ ttype = 3; /* Accepts LINUX mode */
} else if (strstr(term, "vt100") && terminal_width == 40) {
ttype = 7; /* No color support, only 40 columns */
} else if (!strncmp(term, "st", 2)) {
ttype = 1; /* suckless simple terminal is xterm-256color-compatible */
}
} }
int always_escape = 0; /* Used for text mode */ int always_escape = 0; /* Used for text mode */