Fix add_note()

src/botmsg.c

@@ -755,7 +755,7 @@ int add_note(char *to, char *from, char *msg, int idx, int echo)
 {
   #define FROMLEN 40
   int status, i, iaway, sock;
-  char *p, botf[FROMLEN + 1 + HANDLEN + 1], ss[81], ssf[20 + 1 + sizeof botf];
+  char *p, botf[FROMLEN + 1 + HANDLEN + 1], ss[21], ssf[20 + 1 + sizeof botf], *endptr;
   struct userrec *u;
 
   /* Notes have a length limit. Note + PRIVMSG header + nick + date must
@@ -812,14 +812,19 @@ int add_note(char *to, char *from, char *msg, int idx, int echo)
   }
 
   /* Might be form "sock:nick" */
-  splitc(ssf, from, ':');
+  splitcn(ssf, from, ':', sizeof ssf);
   rmspace(ssf);
-  splitc(ss, to, ':');
+  splitcn(ss, to, ':', sizeof ss);
   rmspace(ss);
   if (!ss[0])
     sock = -1;
-  else
-    sock = atoi(ss);
+  else {
+    sock = strtoul(ss, &endptr, 10);
+    if (*endptr) {
+      putlog(LOG_MISC, "*", "add_note(): bogus socket");
+      return NOTE_ERROR;
+    }
+  }
 
   /* Don't process if there's a note binding for it */
   if (idx != -2) {            /* Notes from bots don't trigger it */

src/misc.c

@@ -190,6 +190,8 @@ int my_strcpy(char *a, const char *b)
 }
 
 /* Split first word off of rest and put it in first
+ *
+ * Please use splitcn() instead
  */
 void splitc(char *first, char *rest, char divider)
 {
@@ -207,14 +209,11 @@ void splitc(char *first, char *rest, char divider)
     memmove(rest, p + 1, strlen(p + 1) + 1);
 }
 
-/*    As above, but lets you specify the 'max' number of bytes (EXCLUDING the
- * terminating null).
+/* As above, but lets you specify the 'max' number of bytes
  *
  * Example of use:
  *
- * char buf[HANDLEN + 1];
- *
- * splitcn(buf, input, "@", HANDLEN);
+ * splitcn(buf, input, "@", sizeof buf);
  *
  * <Cybah>
  */