File tuxmath-bufferoverflowstrncat.patch of Package tuxmath

Overview Repositories Revisions Requests Users Attributes Meta

File tuxmath-bufferoverflowstrncat.patch of Package tuxmath (Revision a30b358a41cc24a6148821e1d597ae3e)

Currently displaying revision a30b358a41cc24a6148821e1d597ae3e , Show latest

Index: src/server.c
===================================================================
--- src/server.c.orig
+++ src/server.c
@@ -185,11 +185,11 @@ int RunServer_prog(int argc, char* argv[
   snprintf(buf, 256, "tuxmathserver ");
   for(i = 1; i < argc; i++)
   {
-    strncat(buf, argv[i], 256);
-    strncat(buf, " ", 256);
+    strncat(buf, argv[i], 255);
+    strncat(buf, " ", 255);
   }
   /* Add '&' to make it non-blocking: */
-  strncat(buf, "&", 256);
+  strncat(buf, "&", 255);
 
   return system(buf);
 }
@@ -455,21 +455,27 @@ void check_UDP(void)
   // See if packet contains identifying string:
   if(strncmp((char*)in->data, "TUXMATH_CLIENT", strlen("TUXMATH_CLIENT")) == 0)
   {
-    UDPpacket* out;
+    UDPpacket *out;
     int sent = 0;
     char buf[NET_BUF_LEN];
     // Send "I am here" reply so client knows where to connect socket,
     // with configurable identifying string so user can distinguish 
     // between multiple servers on same network (e.g. "Mrs. Adams' Class");
     out = SDLNet_AllocPacket(NET_BUF_LEN); 
-    snprintf(buf, NET_BUF_LEN, "%s\t%s", "TUXMATH_SERVER", server_name);
-    snprintf(out->data, NET_BUF_LEN, "%s", buf);
-    out->len = strlen(buf) + 1;
-    out->address.host = in->address.host;
-    out->address.port = in->address.port;
-
-    sent = SDLNet_UDP_Send(udpsock, -1, out);
+    if (!out){
+        printf("SDLNet_AllocPacket: %s\n", SDLNet_GetError());
+        cleanup_server();
+        exit(EXIT_FAILURE);
+    }
+    else {
+        snprintf(buf, NET_BUF_LEN, "%s\t%s", "TUXMATH_SERVER", server_name);
+        snprintf((char *)out->data, NET_BUF_LEN, "%s", buf);
+        out->len = strlen(buf) + 1;
+        out->address.host = in->address.host;
+        out->address.port = in->address.port;
 
+        sent = SDLNet_UDP_Send(udpsock, -1, out);
+    }
     SDLNet_FreePacket(out); 
   }
 }

Places

File tuxmath-bufferoverflowstrncat.patch of Package tuxmath (Revision a30b358a41cc24a6148821e1d597ae3e)

Places