Fix buffer overflow in introduce_client and burst_TS6

If the client being introduced has more than 10 user modes send_umode()
will overflow ubuf

(cherry picked from commit 9744d53ec9024a7fa2ec017229bc384086964db1)

diff --git a/src/s_serv.c b/src/s_serv.c
index 2470964d2fe01e1041f5c1b5c0fc8cc09fcbe7ac..1224b7c8aa718f8e8f81cf3e9326d3f7a16a1d28 100644 (file)
--- a/src/s_serv.c
+++ b/src/s_serv.c
@@ -545,7 +545,7 @@ burst_modes_TS6(struct Client *client_p, struct Channel *chptr,
 static void
 burst_TS6(struct Client *client_p)
 {
-       static char ubuf[12];
+       char ubuf[BUFSIZE];
        struct Client *target_p;
        struct Channel *chptr;
        struct membership *msptr;

diff --git a/src/s_user.c b/src/s_user.c
index e6fc1151e9e1951a75317f84e2b684ecbd21b0cd..f06f396d142c1e25ee39be18eafad114deaf8258 100644 (file)
--- a/src/s_user.c
+++ b/src/s_user.c
@@ -582,7 +582,7 @@ register_local_user(struct Client *client_p, struct Client *source_p, const char
 int
 introduce_client(struct Client *client_p, struct Client *source_p, struct User *user, const char *nick, int use_euid)
 {
-       static char ubuf[12];
+       char ubuf[BUFSIZE];
        struct Client *identifyservice_p;
        char *p;
        hook_data_umode_changed hdata;