File kvirc-ctcp_vul.diff of Package kvirc

Overview Repositories Revisions Requests Users Attributes Meta

File kvirc-ctcp_vul.diff of Package kvirc (Revision 572f487197f0f566e7c06b739bbd8c4b)

Currently displaying revision 572f487197f0f566e7c06b739bbd8c4b , Show latest

Index: src/modules/dcc/requests.cpp
===================================================================
--- src/modules/dcc/requests.cpp	(revision 4692)
+++ src/modules/dcc/requests.cpp	(revision 4693)
@@ -86,7 +86,8 @@
 	if(KVI_OPTION_BOOL(KviOption_boolNotifyFailedDccHandshakes))
 	{
 		QString szError = QString("Sorry, your DCC %1 request can't be satisfied: %2").arg(dcc->szType.ptr(), errText);
-		dcc_module_reply_errmsg(dcc,szError);
+		//since szError contains an user-suppplied string, we simplify it to avoid any kind of injection (bug #858)
+		dcc_module_reply_errmsg(dcc,szError.simplified());
 	}
 }
 
Index: src/kvirc/sparser/kvi_sp_ctcp.cpp
===================================================================
--- src/kvirc/sparser/kvi_sp_ctcp.cpp	(revision 4692)
+++ src/kvirc/sparser/kvi_sp_ctcp.cpp	(revision 4693)
@@ -626,7 +626,7 @@
 }
 
 
-const char * KviServerParser::extractCtcpParameter(const char * msg_ptr,KviStr &buffer,bool bSpaceBreaks)
+const char * KviServerParser::extractCtcpParameter(const char * msg_ptr,KviStr &buffer,bool bSpaceBreaks, bool bSafeOnly)
 {
 	//
 	// This one extracts the "next" ctcp parameter in msg_ptr
@@ -658,17 +658,20 @@
 		{
 			case '\\':
 				// backslash : escape sequence
-				if(msg_ptr != begin)buffer.append(begin,msg_ptr - begin);
-				msg_ptr++;
-				if(*msg_ptr)
-				{
-					// decode the escape
-					msg_ptr = decodeCtcpEscape(msg_ptr,buffer);
-					begin = msg_ptr;
+				if(bSafeOnly)msg_ptr++;
+				else {
+					if(msg_ptr != begin)buffer.append(begin,msg_ptr - begin);
+					msg_ptr++;
+					if(*msg_ptr)
+					{
+						// decode the escape
+						msg_ptr = decodeCtcpEscape(msg_ptr,buffer);
+						begin = msg_ptr;
+					}
+					// else it is a senseless trailing backslash.
+					// Just ignore and let the function
+					// return spontaneously.
 				}
-				// else it is a senseless trailing backslash.
-				// Just ignore and let the function
-				// return spontaneously.
 			break;
 			case ' ':
 				// space : separate tokens if not in string
@@ -683,7 +686,7 @@
 				}
 			break;
 			case '"':
-				if(bInString)
+				if(bInString && !bSafeOnly)
 				{
 					// A string terminator. We don't return
 					// immediately since if !bSpaceBreaks
@@ -711,7 +714,7 @@
 	return msg_ptr;
 }
 
-const char * KviServerParser::extractCtcpParameter(const char * p_msg_ptr,QString &resultBuffer,bool bSpaceBreaks)
+const char * KviServerParser::extractCtcpParameter(const char * p_msg_ptr,QString &resultBuffer,bool bSpaceBreaks, bool bSafeOnly)
 {
 	//
 	// This one extracts the "next" ctcp parameter in p_msg_ptr
@@ -743,15 +746,18 @@
 		{
 			case '\\':
 				// backslash : escape sequence
-				msg_ptr++;
-				if(*msg_ptr)
-				{
-					// decode the escape
-					msg_ptr = decodeCtcpEscape(msg_ptr,buffer);
+				if(bSafeOnly)msg_ptr++;
+				else {
+					msg_ptr++;
+					if(*msg_ptr)
+					{
+						// decode the escape
+						msg_ptr = decodeCtcpEscape(msg_ptr,buffer);
+					}
+					// else it is a senseless trailing backslash.
+					// Just ignore and let the function
+					// return spontaneously.
 				}
-				// else it is a senseless trailing backslash.
-				// Just ignore and let the function
-				// return spontaneously.
 			break;
 			case ' ':
 				// space : separate tokens if not in string
@@ -769,7 +775,7 @@
 				}
 			break;
 			case '"':
-				if(bInString)
+				if(bInString && !bSafeOnly)
 				{
 					// A string terminator. We don't return
 					// immediately since if !bSpaceBreaks
@@ -1707,7 +1713,7 @@
 {
 	KviDccRequest p;
 	KviStr aux    = msg->pData;
-	msg->pData    = extractCtcpParameter(msg->pData,p.szType);
+	msg->pData    = extractCtcpParameter(msg->pData,p.szType, true, true);
 	msg->pData    = extractCtcpParameter(msg->pData,p.szParam1);
 	msg->pData    = extractCtcpParameter(msg->pData,p.szParam2);
 	msg->pData    = extractCtcpParameter(msg->pData,p.szParam3);
Index: src/kvirc/sparser/kvi_sparser.h
===================================================================
--- src/kvirc/sparser/kvi_sparser.h	(revision 4692)
+++ src/kvirc/sparser/kvi_sparser.h	(revision 4693)
@@ -260,8 +260,8 @@
 	static void encodeCtcpParameter(const char * param,QString &buffer,bool bSpaceBreaks = true);
 	static const char * decodeCtcpEscape(const char * msg_ptr,KviStr &buffer);
 	static const char * decodeCtcpEscape(const char * msg_ptr,QByteArray &buffer);
-	static const char * extractCtcpParameter(const char * msg_ptr,KviStr &buffer,bool bSpaceBreaks = true);
-	static const char * extractCtcpParameter(const char * msg_ptr,QString &buffer,bool bSpaceBreaks = true);
+	static const char * extractCtcpParameter(const char * msg_ptr,KviStr &buffer,bool bSpaceBreaks = true, bool bSafeOnly=false);
+	static const char * extractCtcpParameter(const char * msg_ptr,QString &buffer,bool bSpaceBreaks = true, bool bSafeOnly=false);
 };
 
 #ifndef _KVI_SPARSER_CPP_

Places

File kvirc-ctcp_vul.diff of Package kvirc (Revision 572f487197f0f566e7c06b739bbd8c4b)

Places