* Port [3919] to 1.2.16 from trunk

 * Fixed cmd_handle not properly bounds checking max handlen. (fixes #305)


svn: 3920

doc/UPDATES

@@ -17,6 +17,7 @@
 * Fixed countless buffer overflows. (fixes #226)
 * Fixed a rare segfault on userfile transfer timeouts
 * Fixed bots getting confused about their hub/uplink after userfile transfer fails (fixes #61)
+* Fixed cmd_handle not properly bounds checking max handlen. (fixes #305)
 
 1.2.15 - http://wraith.botpack.net/milestone/1.2.15
 * Fix a possible segfault when binaries compiled wrong

src/cmds.c

@@ -1178,7 +1178,7 @@ static void cmd_handle(int idx, char *par)
 {
   char newhandle[HANDLEN + 1] = "";
 
-  strncpy(newhandle, newsplit(&par), sizeof newhandle);
+  strlcpy(newhandle, newsplit(&par), sizeof newhandle);
 
   if (!newhandle[0]) {
     dprintf(idx, "Usage: handle <new-handle>\n");
@@ -1192,10 +1192,8 @@ static void cmd_handle(int idx, char *par)
     dprintf(idx, "Sorry, perm owners may not change their handle without recompiling binaries.\n");
     return;
   } else if (strchr(BADHANDCHARS, newhandle[0]) != NULL) {
-    dprintf(idx, "Bizarre quantum forces prevent handle from starting with '%c'.\n",
-	    newhandle[0]);
-  } else if (get_user_by_handle(userlist, newhandle) &&
-	     egg_strcasecmp(dcc[idx].nick, newhandle)) {
+    dprintf(idx, "Bizarre quantum forces prevent handle from starting with '%c'.\n", newhandle[0]);
+  } else if (get_user_by_handle(userlist, newhandle) && egg_strcasecmp(dcc[idx].nick, newhandle)) {
     dprintf(idx, "Somebody is already using %s.\n", newhandle);
   } else if (!egg_strcasecmp(newhandle, conf.bot->nick)) {
     dprintf(idx, "Hey!  That's MY name!\n");

src/userrec.c

@@ -558,6 +558,7 @@ int change_handle(struct userrec *u, char *newh)
 	if (dcc[i].u.chat->channel < GLOBAL_CHANS)
 	  botnet_send_nkch(i, s);
       }
+      break;
     }
   return 1;
 }