File tuxmath-bufferoverflowstrncat.patch of Package tuxmath

Overview Repositories Revisions Requests Users Attributes Meta

File tuxmath-bufferoverflowstrncat.patch of Package tuxmath (Revision 6503d3af038912f62b62e2ae16034519)

Currently displaying revision 6503d3af038912f62b62e2ae16034519 , Show latest

Index: src/server.c
===================================================================
--- src/server.c.orig
+++ src/server.c
@@ -213,11 +213,11 @@ int RunServer_prog(int argc, char* argv[
   snprintf(buf, 256, "tuxmathserver ");
   for(i = 1; i < argc; i++)
   {
-    strncat(buf, argv[i], 256);
-    strncat(buf, " ", 256);
+    strncat(buf, argv[i], 255);
+    strncat(buf, " ", 255);
   }
   /* Add '&' to make it non-blocking: */
-  strncat(buf, "&", 256);
+  strncat(buf, "&", 255);
 
   DEBUGMSG(debug_lan, "RunServer_prog() - launching standalone " 
 		  "tuxmathserver program with \"system(%s)\"\n", buf);
@@ -512,22 +512,27 @@ void check_UDP(void)
   // See if packet contains identifying string:
   if(strncmp((char*)in->data, "TUXMATH_CLIENT", strlen("TUXMATH_CLIENT")) == 0)
   {
-    UDPpacket* out;
+    UDPpacket *out;
     int sent = 0;
     char buf[NET_BUF_LEN];
     // Send "I am here" reply so client knows where to connect socket,
     // with configurable identifying string so user can distinguish 
     // between multiple servers on same network (e.g. "Mrs. Adams' Class");
     out = SDLNet_AllocPacket(NET_BUF_LEN); 
-    snprintf(buf, NET_BUF_LEN, "%s\t%s\t%s",
-             "TUXMATH_SERVER", server_name, Opts_LessonTitle());
-    snprintf(out->data, NET_BUF_LEN, "%s", buf);
-    out->len = strlen(buf) + 1;
-    out->address.host = in->address.host;
-    out->address.port = in->address.port;
-
-    sent = SDLNet_UDP_Send(udpsock, -1, out);
+    if (!out){
+	    printf("SDLNet_AllocPacket: %s\n", SDLNet_GetError());
+	    cleanup_server();
+	    exit(EXIT_FAILURE);
+	}
+	else {
+	    snprintf(buf, NET_BUF_LEN, "%s\t%s\t%s", "TUXMATH_SERVER", server_name, Opts_LessonTitle());
+	    snprintf(out->data, NET_BUF_LEN, "%s", buf);
+	    out->len = strlen(buf) + 1;
+	    out->address.host = in->address.host;
+	    out->address.port = in->address.port;
 
+		sent = SDLNet_UDP_Send(udpsock, -1, out);
+	}
     SDLNet_FreePacket(out); 
   }
 }

Places

File tuxmath-bufferoverflowstrncat.patch of Package tuxmath (Revision 6503d3af038912f62b62e2ae16034519)

Places