Skip to content

Commit 1f6d650

Browse files
msaarnamsaarna
committed
foundation: add safety guards to string manipulation
1 parent 45750fc commit 1f6d650

3 files changed

Lines changed: 38 additions & 23 deletions

File tree

‎7800bas.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -113,7 +113,7 @@ int main (int argc, char *argv[])
113113
prefilename = optarg;
114114
break;
115115
case 'v':
116-
printf ("%s (%s, %s)\n", BASIC_VERSION_INFO, __TIME__, __DATE__);
116+
fprintf (stdout,"%s (%s, %s)\n", BASIC_VERSION_INFO, __TIME__, __DATE__);
117117
exit (0);
118118
case '?':
119119
fprintf (stderr, "usage: %s -r <variable redefs file> -i <includes path>\n", argv[0]);
@@ -296,7 +296,7 @@ int main (int argc, char *argv[])
296296
// look for defines and remember them
297297
strcpy (mycode, code);
298298
int k_def_search;
299-
for (k_def_search = 0; k_def_search < 495; ++k_def_search)
299+
for (k_def_search = 0; k_def_search < 495 && code[k_def_search] != '\0'; ++k_def_search)
300300
if (code[k_def_search] == ' ')
301301
break;
302302
if (k_def_search < 495 && code[k_def_search] == ' ' &&

‎keywords.c‎

Lines changed: 29 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -104,18 +104,18 @@ void keywords (char **cstatement)
104104
&& (!strncmp (cstatement[k + 1], "if", 2)) && (isConditionalContinuationToken (cstatement[k + 5])))
105105
{
106106
// swap operands and switch compare
107-
strncpy (cstatement[k + 3], cstatement[k + 2],200); // stick 1st operand here temporarily
108-
strncpy (cstatement[k + 2], cstatement[k + 4],200);
109-
strncpy (cstatement[k + 4], cstatement[k + 3],200); // get it back
107+
strncpy (cstatement[k + 3], cstatement[k + 2],200); cstatement[k+3][200] = '\0'; // stick 1st operand here temporarily
108+
strncpy (cstatement[k + 2], cstatement[k + 4],200); cstatement[k+2][200] = '\0';
109+
strncpy (cstatement[k + 4], cstatement[k + 3],200); cstatement[k+4][200] = '\0'; // get it back
110110
strcpy (cstatement[k + 3], "<"); // replace compare
111111
}
112112
else if (!strncmp (cstatement[k + 3], "<=", 2)
113113
&& (!strncmp (cstatement[k + 1], "if", 2)) && (isConditionalContinuationToken (cstatement[k + 5])))
114114
{
115115
// swap operands and switch compare
116-
strncpy (cstatement[k + 3], cstatement[k + 2],200);
117-
strncpy (cstatement[k + 2], cstatement[k + 4],200);
118-
strncpy (cstatement[k + 4], cstatement[k + 3],200);
116+
strncpy (cstatement[k + 3], cstatement[k + 2],200); cstatement[k+3][200] = '\0';
117+
strncpy (cstatement[k + 2], cstatement[k + 4],200); cstatement[k+2][200] = '\0';
118+
strncpy (cstatement[k + 4], cstatement[k + 3],200); cstatement[k+4][200] = '\0';
119119
strcpy (cstatement[k + 3], ">=");
120120
}
121121
if (!strncmp (cstatement[k + 3], "&&", 2))
@@ -137,23 +137,26 @@ void keywords (char **cstatement)
137137
&& (!strncmp (cstatement[k + 1], "if", 2)) && (isConditionalContinuationToken (cstatement[k + 7])))
138138
{
139139
// swap operands and switch compare
140-
strncpy (cstatement[k + 5], cstatement[k + 4],200); // stick 1st operand here temporarily
141-
strncpy (cstatement[k + 4], cstatement[k + 6],200);
142-
strncpy (cstatement[k + 6], cstatement[k + 5],200); // get it back
140+
strncpy (cstatement[k + 5], cstatement[k + 4],200); cstatement[k+5][200] = '\0';// stick 1st operand here temporarily
141+
strncpy (cstatement[k + 4], cstatement[k + 6],200); cstatement[k+4][200] = '\0';
142+
strncpy (cstatement[k + 6], cstatement[k + 5],200); cstatement[k+6][200] = '\0';// get it back
143143
strcpy (cstatement[k + 5], "<"); // replace compare
144144
}
145145
else if (!strncmp (cstatement[k + 5], "<=", 2)
146146
&& (!strncmp (cstatement[k + 1], "if", 2)) && (isConditionalContinuationToken (cstatement[k + 7])))
147147
{
148148
// swap operands and switch compare
149-
strncpy (cstatement[k + 5], cstatement[k + 4],200);
150-
strncpy (cstatement[k + 4], cstatement[k + 6],200);
151-
strncpy (cstatement[k + 6], cstatement[k + 5],200);
149+
strncpy (cstatement[k + 5], cstatement[k + 4],200); cstatement[k+5][200] = '\0';
150+
strncpy (cstatement[k + 4], cstatement[k + 6],200); cstatement[k+4][200] = '\0';
151+
strncpy (cstatement[k + 6], cstatement[k + 5],200); cstatement[k+6][200] = '\0';
152152
strcpy (cstatement[k + 5], ">=");
153153
}
154154

155155
for (i = 2; i < 198 - k; ++i)
156-
strncpy (orstatement[i], cstatement[k + i + 2],200);
156+
{
157+
strncpy (orstatement[i], cstatement[k + i + 2],200);
158+
orstatement[i][200] = '\0';
159+
}
157160
if (!strncmp (cstatement[k + 5], "then", 4))
158161
compressdata (cstatement, k + 3, k + 2);
159162
else if (!strncmp (cstatement[k + 7], "then", 4))
@@ -171,22 +174,25 @@ void keywords (char **cstatement)
171174
&& (!strncmp (cstatement[k + 1], "if", 2)) && (isConditionalContinuationToken (cstatement[k + 9])))
172175
{
173176
// swap operands and switch compare
174-
strncpy (cstatement[k + 7], cstatement[k + 6],200); // stick 1st operand here temporarily
175-
strncpy (cstatement[k + 6], cstatement[k + 8],200);
176-
strncpy (cstatement[k + 8], cstatement[k + 7],200); // get it back
177+
strncpy (cstatement[k + 7], cstatement[k + 6],200); cstatement[k+7][200] = '\0';// stick 1st operand here temporarily
178+
strncpy (cstatement[k + 6], cstatement[k + 8],200); cstatement[k+6][200] = '\0';
179+
strncpy (cstatement[k + 8], cstatement[k + 7],200); cstatement[k+8][200] = '\0';// get it back
177180
strcpy (cstatement[k + 7], "<"); // replace compare
178181
}
179182
else if (!strncmp (cstatement[k + 7], "<=", 2)
180183
&& (!strncmp (cstatement[k + 1], "if", 2)) && (isConditionalContinuationToken (cstatement[k + 9])))
181184
{
182185
// swap operands and switch compare
183-
strncpy (cstatement[k + 7], cstatement[k + 6],200);
184-
strncpy (cstatement[k + 6], cstatement[k + 8],200);
185-
strncpy (cstatement[k + 8], cstatement[k + 7],200);
186+
strncpy (cstatement[k + 7], cstatement[k + 6],200); cstatement[k+7][200] = '\0';
187+
strncpy (cstatement[k + 6], cstatement[k + 8],200); cstatement[k+6][200] = '\0';
188+
strncpy (cstatement[k + 8], cstatement[k + 7],200); cstatement[k+8][200] = '\0';
186189
strcpy (cstatement[k + 7], ">=");
187190
}
188191
for (i = 2; i < 196 - k; ++i)
192+
{
189193
strncpy (orstatement[i], cstatement[k + i + 4],200);
194+
orstatement[i][200] = '\0';
195+
}
190196
if (!strncmp (cstatement[k + 7], "then", 4))
191197
compressdata (cstatement, k + 5, k + 2);
192198
else if (!strncmp (cstatement[k + 9], "then", 4))
@@ -214,7 +220,10 @@ void keywords (char **cstatement)
214220
}
215221

216222
for (i = foundelse; i < 200; ++i)
223+
{
217224
strncpy (elstatement[i - foundelse], pass2elstatement[i],200);
225+
elstatement[i - foundelse][200] = '\0';
226+
}
218227
if (islabelelse (pass2elstatement))
219228
{
220229
strcpy (pass2elstatement[foundelse++], ":");
@@ -226,6 +235,7 @@ void keywords (char **cstatement)
226235
if (!islabelelse (elstatement))
227236
{
228237
strncpy (elstatement[2], elstatement[1],200);
238+
elstatement[2][200] = '\0';
229239
strcpy (elstatement[1], "goto");
230240
}
231241
if (door)

‎statements.c‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2306,6 +2306,11 @@ void plotmapfile (char **statement)
23062306

23072307
//get the tile value...
23082308
gid = atoi (keyword + 10);
2309+
if (gid >= 256)
2310+
{
2311+
prwarn("plotmapfile tile gid '%d' is out of bounds (max 255), skipping", gid);
2312+
continue;
2313+
}
23092314

23102315
if (gid == 0)
23112316
gid = 1; //kludge - to work around empty characters
@@ -3716,7 +3721,7 @@ void incmapfile (char **statement)
37163721
{
37173722
gid = atoi (firstgid + 10);
37183723
tilename = tilename + 6;
3719-
for (t = 0; t < 1024; t++)
3724+
for (t = 0; t < line_len; t++)
37203725
if (line[t] == '"')
37213726
line[t] = 0;
37223727
s = 0;
@@ -3745,7 +3750,7 @@ void incmapfile (char **statement)
37453750
{
37463751
free(file_buffer);
37473752
keyword = keyword + 15;
3748-
for (t = 0; t < 1024; t++)
3753+
for (t = 0; t < line_len; t++)
37493754
if (line[t] == '"')
37503755
line[t] = 0;
37513756
prerror ("map file '%s' is %s encoded. XML is required", statement[2], keyword);

0 commit comments

Comments
 (0)