BUILD : 1.7.22 (1449) BUGS : NOTES : Applied a patch by w00t to fix possible buffer overflows in NS/CS REGISTER. As of now the max pass length is 31 instead of 32 characters.

git-svn-id: svn://svn.anope.org/anope/trunk@1449 31f1291d-b8d6-0310-a050-a5561fc1590b


git-svn-id: http://anope.svn.sourceforge.net/svnroot/anope/trunk@1163 5417fbe8-f217-4b02-8779-1006273d7864

4 files changed, 13 insertions, 8 deletions

diff --git a/Changes b/Changes
index 6d868757a..bf15f6e07 100644
--- a/Changes
+++ b/Changes
@@ -6,6 +6,7 @@ Anope Version  S V N
 Provided by Robin Burchell <w00t@inspircd.org> - 2008
 09/22 F Enabled UMODE functionality for InspIRCd 1.1                      [ #00]
 09/22 F Fix pointer comparison on non-ptr in CS CLEAR.                    [ #00]
+09/23 F Possible buffer overflow in NS/CS REGISTER.                       [ #00]
 
 Anope Version 1.7.22
 --------------------
diff --git a/src/core/cs_register.c b/src/core/cs_register.c
index 73319b36f..d8cf4e817 100644
--- a/src/core/cs_register.c
+++ b/src/core/cs_register.c
@@ -76,7 +76,7 @@ int do_register(User * u)
     ChannelInfo *ci;
     struct u_chaninfolist *uc;
     int is_servadmin = is_services_admin(u);
-    char founderpass[PASSMAX + 1];
+    char founderpass[PASSMAX];
     char tmp_pass[PASSMAX];
 
     if (readonly) {
@@ -124,13 +124,13 @@ int do_register(User * u)
     } else if (stricmp(u->nick, pass) == 0
                || (StrictPasswords && strlen(pass) < 5)) {
         notice_lang(s_ChanServ, u, MORE_OBSCURE_PASSWORD);
-    } else if(enc_encrypt_check_len(strlen(pass) ,PASSMAX)) {
+    } else if(enc_encrypt_check_len(strlen(pass), PASSMAX - 1)) {
         notice_lang(s_ChanServ, u, PASSWORD_TOO_LONG);
     } else if (!(ci = makechan(chan))) {
         alog("%s: makechan() failed for REGISTER %s", s_ChanServ, chan);
         notice_lang(s_ChanServ, u, CHAN_REGISTRATION_FAILED);
 
-    } else if (strscpy(founderpass, pass, PASSMAX + 1),
+    } else if (strscpy(founderpass, pass, PASSMAX),
                enc_encrypt_in_place(founderpass, PASSMAX) < 0) {
         alog("%s: Couldn't encrypt password for %s (REGISTER)",
              s_ChanServ, chan);
@@ -164,7 +164,7 @@ int do_register(User * u)
              u->nick, u->username, u->host);
         notice_lang(s_ChanServ, u, CHAN_REGISTERED, chan, u->nick);
 
-        if(enc_decrypt(ci->founderpass,tmp_pass,PASSMAX) == 1) {
+        if(enc_decrypt(ci->founderpass,tmp_pass,PASSMAX - 1) == 1) {
             notice_lang(s_ChanServ, u, CHAN_PASSWORD_IS, tmp_pass);
         }
 
diff --git a/src/core/ns_register.c b/src/core/ns_register.c
index de9ec7d7b..9886fbf3a 100644
--- a/src/core/ns_register.c
+++ b/src/core/ns_register.c
@@ -185,7 +185,7 @@ int do_register(User * u)
     } else if (stricmp(u->nick, pass) == 0
                || (StrictPasswords && strlen(pass) < 5)) {
         notice_lang(s_NickServ, u, MORE_OBSCURE_PASSWORD);
-    } else if (enc_encrypt_check_len(strlen(pass), PASSMAX)) {
+    } else if (enc_encrypt_check_len(strlen(pass), PASSMAX - 1)) {
         notice_lang(s_NickServ, u, PASSWORD_TOO_LONG);
     } else if (email && !MailValidate(email)) {
         notice_lang(s_NickServ, u, MAIL_X_INVALID, email);
@@ -309,7 +309,7 @@ int do_confirm(User * u)
 
         len = strlen(pass);
         na->nc->pass = smalloc(PASSMAX);
-        if (enc_encrypt(pass, len, na->nc->pass, PASSMAX) < 0) {
+        if (enc_encrypt(pass, len, na->nc->pass, PASSMAX - 1) < 0) {
             memset(pass, 0, strlen(pass));
             alog("%s: Failed to encrypt password for %s (register)",
                  s_NickServ, nr->nick);
@@ -365,7 +365,7 @@ int do_confirm(User * u)
                             u->nick);
             send_event(EVENT_NICK_REGISTERED, 1, u->nick);
         
-        if(enc_decrypt(na->nc->pass,tmp_pass,PASSMAX)==1) 
+        if(enc_decrypt(na->nc->pass, tmp_pass, PASSMAX - 1)==1) 
                 notice_lang(s_NickServ, u, NICK_PASSWORD_IS, tmp_pass);
 
             u->lastnickreg = time(NULL);
diff --git a/version.log b/version.log
index 6596209aa..f00ab755f 100644
--- a/version.log
+++ b/version.log
@@ -9,10 +9,14 @@ VERSION_MAJOR="1"
 VERSION_MINOR="7"
 VERSION_PATCH="22"
 VERSION_EXTRA="-svn"
-VERSION_BUILD="1448"
+VERSION_BUILD="1449"
 
 # $Log$
 #
+# BUILD : 1.7.22 (1449)
+# BUGS  : 
+# NOTES :  Applied a patch by w00t to fix possible buffer overflows in NS/CS REGISTER. As of now the max pass length is 31 instead of 32 characters. 
+#
 # BUILD : 1.7.22 (1448)
 # BUGS  : 
 # NOTES : Applied patch by w00t to remove a pointer comparison on a non-ptr in cs_clear.c