cap-notify: Fix possible crash on 64-bit systems.

[solanum.git] / modules / m_links.c

diff --git a/modules/m_links.c b/modules/m_links.c
index e4a0f881142b8bedd2f8b59992bcce4ec476cbfe..5918659d02795b9b225c86d3f2c3428b9ea23a8e 100644 (file)
--- a/modules/m_links.c
+++ b/modules/m_links.c
@@ -37,6 +37,7 @@
 #include "modules.h"
 #include "hook.h"
 #include "scache.h"
+#include "s_assert.h"
 
 static int m_links(struct Client *, struct Client *, int, const char **);
 static int mo_links(struct Client *, struct Client *, int, const char **);
@@ -59,11 +60,9 @@ DECLARE_MODULE_AV1(links, NULL, NULL, links_clist, links_hlist, NULL, "$Revision
 
 /*
  * m_links - LINKS message handler
- *      parv[0] = sender prefix
  *      parv[1] = servername mask
  * or
- *      parv[0] = sender prefix
- *      parv[1] = server to query 
+ *      parv[1] = server to query
  *      parv[2] = servername mask
  */
 static int
@@ -89,6 +88,8 @@ mo_links(struct Client *client_p, struct Client *source_p, int parc, const char
 
        if(parc > 2)
        {
+               if(strlen(parv[2]) > HOSTLEN)
+                       return 0;
                if(hunt_server(client_p, source_p, ":%s LINKS %s :%s", 1, parc, parv)
                   != HUNTED_ISME)
                        return 0;
@@ -116,7 +117,7 @@ mo_links(struct Client *client_p, struct Client *source_p, int parc, const char
                        continue;
 
                /* We just send the reply, as if theyre here theres either no SHIDE,
-                * or theyre an oper..  
+                * or theyre an oper..
                 */
                sendto_one_numeric(source_p, RPL_LINKS, form_str(RPL_LINKS),
                                   target_p->name, target_p->servptr->name,
@@ -140,19 +141,21 @@ clean_string(char *dest, const unsigned char *src, size_t len)
        if(dest == NULL || src == NULL)
                return NULL;
 
-       len -= 3;               /* allow for worst case, '^A\0' */
-
-       while (*src && (len > 0))
+       while (*src && (len > 1))
        {
                if(*src & 0x80) /* if high bit is set */
                {
                        *d++ = '.';
                        --len;
+                       if(len <= 1)
+                               break;
                }
                else if(!IsPrint(*src)) /* if NOT printable */
                {
                        *d++ = '^';
                        --len;
+                       if(len <= 1)
+                               break;
                        *d++ = 0x40 + *src;     /* turn it into a printable */
                }
                else