Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix SERVER_NICKLEN off-by-one error #1549

Merged
merged 2 commits into from
May 5, 2024

Conversation

michaelortmann
Copy link
Member

@michaelortmann michaelortmann commented Mar 17, 2024

Found by: michaelortmann
Patch by: michaelortmann
Fixes:

One-line summary:
Fix SERVER_NICKLEN off-by-one error

Additional description (if needed):

nicklen = (*(int *)me->funcs[SERVER_NICKLEN]);

#define SERVER_NICKLEN 38

#define nick_len (*(int *)(server_funcs[37]))
#define check_tcl_notc ((int (*)(char *,char *,struct userrec *,char *,char *))server_funcs[38])

Test cases demonstrating functionality (if applicable):
Bug can be triggert by loading server mod and filesys mod, starting eggdrop and issuing .files and get
I didnt analyze the implication any further, but this has crash potential, because currently it would not only set nicklen to a random value (in my test 1447122753) but also trigger a load of misaligned address

@vanosg vanosg added this to the v1.10.0 milestone May 5, 2024
@thommey
Copy link
Member

thommey commented May 5, 2024

nice find!

@vanosg vanosg merged commit 077eb4e into eggheads:develop May 5, 2024
2 checks passed
@michaelortmann michaelortmann deleted the fix.SERVER_NICKLEN branch May 6, 2024 13:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants