瀏覽代碼

* Fix overlapping strcpy() [found by ircfuzz, also fixed in eggdrop]

Bryan Drewery 16 年之前
父節點
當前提交
4a644dfb7f
共有 1 個文件被更改,包括 4 次插入1 次删除
  1. 4 1
      src/mod/server.mod/servmsg.c

+ 4 - 1
src/mod/server.mod/servmsg.c

@@ -548,7 +548,10 @@ static int gotmsg(char *from, char *msg)
       *p = 0;
       strlcpy(ctcpbuf, p1, sizeof(ctcpbuf));
       ctcp = ctcpbuf;
-      strcpy(p1 - 1, p + 1);
+
+      /* remove the ctcp in msg */
+      memmove(p1 - 1, p + 1, strlen(p + 1) + 1);
+
       if (!ignoring)
         detect_flood(nick, uhost, from, strncmp(ctcp, "ACTION ", 7) ? FLOOD_CTCP : FLOOD_PRIVMSG);
       /* Respond to the first answer_ctcp */