BUILD : 1.7.22 (1449) BUGS : NOTES : Applied a patch by w00t to fix possible buffer overflows in NS/CS REGISTER. As of now the max pass length is 31 instead of 32 characters.

git-svn-id: svn://svn.anope.org/anope/trunk@1449 31f1291d-b8d6-0310-a050-a5561fc1590b


git-svn-id: http://anope.svn.sourceforge.net/svnroot/anope/trunk@1163 5417fbe8-f217-4b02-8779-1006273d7864

2 files changed, 7 insertions, 7 deletions

diff --git a/src/core/cs_register.c b/src/core/cs_register.c
index 73319b36f..d8cf4e817 100644
--- a/src/core/cs_register.c
+++ b/src/core/cs_register.c
@@ -76,7 +76,7 @@ int do_register(User * u)
     ChannelInfo *ci;
     struct u_chaninfolist *uc;
     int is_servadmin = is_services_admin(u);
-    char founderpass[PASSMAX + 1];
+    char founderpass[PASSMAX];
     char tmp_pass[PASSMAX];
 
     if (readonly) {
@@ -124,13 +124,13 @@ int do_register(User * u)
     } else if (stricmp(u->nick, pass) == 0
                || (StrictPasswords && strlen(pass) < 5)) {
         notice_lang(s_ChanServ, u, MORE_OBSCURE_PASSWORD);
-    } else if(enc_encrypt_check_len(strlen(pass) ,PASSMAX)) {
+    } else if(enc_encrypt_check_len(strlen(pass), PASSMAX - 1)) {
         notice_lang(s_ChanServ, u, PASSWORD_TOO_LONG);
     } else if (!(ci = makechan(chan))) {
         alog("%s: makechan() failed for REGISTER %s", s_ChanServ, chan);
         notice_lang(s_ChanServ, u, CHAN_REGISTRATION_FAILED);
 
-    } else if (strscpy(founderpass, pass, PASSMAX + 1),
+    } else if (strscpy(founderpass, pass, PASSMAX),
                enc_encrypt_in_place(founderpass, PASSMAX) < 0) {
         alog("%s: Couldn't encrypt password for %s (REGISTER)",
              s_ChanServ, chan);
@@ -164,7 +164,7 @@ int do_register(User * u)
              u->nick, u->username, u->host);
         notice_lang(s_ChanServ, u, CHAN_REGISTERED, chan, u->nick);
 
-        if(enc_decrypt(ci->founderpass,tmp_pass,PASSMAX) == 1) {
+        if(enc_decrypt(ci->founderpass,tmp_pass,PASSMAX - 1) == 1) {
             notice_lang(s_ChanServ, u, CHAN_PASSWORD_IS, tmp_pass);
         }
 
diff --git a/src/core/ns_register.c b/src/core/ns_register.c
index de9ec7d7b..9886fbf3a 100644
--- a/src/core/ns_register.c
+++ b/src/core/ns_register.c
@@ -185,7 +185,7 @@ int do_register(User * u)
     } else if (stricmp(u->nick, pass) == 0
                || (StrictPasswords && strlen(pass) < 5)) {
         notice_lang(s_NickServ, u, MORE_OBSCURE_PASSWORD);
-    } else if (enc_encrypt_check_len(strlen(pass), PASSMAX)) {
+    } else if (enc_encrypt_check_len(strlen(pass), PASSMAX - 1)) {
         notice_lang(s_NickServ, u, PASSWORD_TOO_LONG);
     } else if (email && !MailValidate(email)) {
         notice_lang(s_NickServ, u, MAIL_X_INVALID, email);
@@ -309,7 +309,7 @@ int do_confirm(User * u)
 
         len = strlen(pass);
         na->nc->pass = smalloc(PASSMAX);
-        if (enc_encrypt(pass, len, na->nc->pass, PASSMAX) < 0) {
+        if (enc_encrypt(pass, len, na->nc->pass, PASSMAX - 1) < 0) {
             memset(pass, 0, strlen(pass));
             alog("%s: Failed to encrypt password for %s (register)",
                  s_NickServ, nr->nick);
@@ -365,7 +365,7 @@ int do_confirm(User * u)
                             u->nick);
             send_event(EVENT_NICK_REGISTERED, 1, u->nick);
         
-        if(enc_decrypt(na->nc->pass,tmp_pass,PASSMAX)==1) 
+        if(enc_decrypt(na->nc->pass, tmp_pass, PASSMAX - 1)==1) 
                 notice_lang(s_NickServ, u, NICK_PASSWORD_IS, tmp_pass);
 
             u->lastnickreg = time(NULL);