From f56d47bb19c44faf757ad182b75ff35643cf36b4 Mon Sep 17 00:00:00 2001
From: Michael Ortmann <41313082+michaelortmann@users.noreply.github.com>
Date: Thu, 13 Jun 2024 15:11:02 +0200
Subject: [PATCH] Fix strcpy-param-overlap

---
 src/mod/filesys.mod/files.c  | 2 +-
 src/mod/irc.mod/chan.c       | 4 ++--
 src/mod/server.mod/servmsg.c | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/mod/filesys.mod/files.c b/src/mod/filesys.mod/files.c
index edc491e3dd..5330cd5bcf 100644
--- a/src/mod/filesys.mod/files.c
+++ b/src/mod/filesys.mod/files.c
@@ -171,7 +171,7 @@ static int resolve_dir(char *current, char *change, char **real, int idx)
     *p = 0;
     p++;
     malloc_strcpy(elem, new);
-    strcpy(new, p);
+    memmove(new, p, strlen(p) + 1);
     if (!elem[0] || !strcmp(elem, ".")) {
       p = strchr(new, '/');
       continue;
diff --git a/src/mod/irc.mod/chan.c b/src/mod/irc.mod/chan.c
index f0cb827d71..8f79b0d21d 100644
--- a/src/mod/irc.mod/chan.c
+++ b/src/mod/irc.mod/chan.c
@@ -2599,7 +2599,7 @@ static int gotmsg(char *from, char *msg)
       *p = 0;
       ctcp = buf2;
       strlcpy(buf2, p1, sizeof buf2);
-      memmove(p1 - 1, p + 1, strlen(p));
+      memmove(p1 - 1, p + 1, strlen(p + 1) + 1);
       detect_chan_flood(nick, uhost, from, chan, strncmp(ctcp, "ACTION ", 7) ?
                         FLOOD_CTCP : FLOOD_PRIVMSG, NULL);
 
@@ -2734,7 +2734,7 @@ static int gotnotice(char *from, char *msg)
       *p = 0;
       ctcp = buf2;
       strcpy(ctcp, p1);
-      memmove(p1 - 1, p + 1, strlen(p));
+      memmove(p1 - 1, p + 1, strlen(p + 1) + 1);
       p = strchr(msg, 1);
       detect_chan_flood(nick, uhost, from, chan,
                         strncmp(ctcp, "ACTION ", 7) ?
diff --git a/src/mod/server.mod/servmsg.c b/src/mod/server.mod/servmsg.c
index 952ff70bfe..af27ce6934 100644
--- a/src/mod/server.mod/servmsg.c
+++ b/src/mod/server.mod/servmsg.c
@@ -589,7 +589,7 @@ static int gotmsg(char *from, char *msg)
       ctcp = ctcpbuf;
 
       /* remove the ctcp in msg */
-      memmove(p1 - 1, p + 1, strlen(p));
+      memmove(p1 - 1, p + 1, strlen(p + 1) + 1);
 
       if (!ignoring)
         detect_flood(nick, uhost, from,