Fix add_note() - Followup to #1763

src/botmsg.c

@@ -25,6 +25,7 @@
  */
 
 #include "main.h"
+#include <errno.h>
 #include "tandem.h"
 
 extern struct dcc_t *dcc;
@@ -755,7 +756,8 @@ int add_note(char *to, char *from, char *msg, int idx, int echo)
 {
   #define FROMLEN 40
   int status, i, iaway, sock;
-  char *p, botf[FROMLEN + 1 + HANDLEN + 1], ss[81], ssf[20 + 1 + sizeof botf];
+  long lval;
+  char *p, botf[FROMLEN + 1 + HANDLEN + 1], ss[21], ssf[20 + 1 + sizeof botf], *endptr;
   struct userrec *u;
 
   /* Notes have a length limit. Note + PRIVMSG header + nick + date must
@@ -812,14 +814,26 @@ int add_note(char *to, char *from, char *msg, int idx, int echo)
   }
 
   /* Might be form "sock:nick" */
-  splitc(ssf, from, ':');
+  splitcn(ssf, from, ':', sizeof ssf);
   rmspace(ssf);
-  splitc(ss, to, ':');
+  splitcn(ss, to, ':', sizeof ss);
   rmspace(ss);
-  if (!ss[0])
+  if (!ss[0]) {
     sock = -1;
-  else
-    sock = atoi(ss);
+  } else {
+    errno = 0;
+    lval = strtol(ss, &endptr, 10);
+    if (*endptr) {
+      dprintf(idx, "add_note(): sock not a number");
+      return NOTE_ERROR;
+    }
+    if ((errno == ERANGE && (lval == LONG_MAX || lval == LONG_MIN)) ||
+        (lval > INT_MAX || lval < INT_MIN)) {
+      dprintf(idx, "add_note(): sock out of range");
+      return NOTE_ERROR;
+    }
+    sock = lval;
+  }
 
   /* Don't process if there's a note binding for it */
   if (idx != -2) {            /* Notes from bots don't trigger it */

src/cmds.c

@@ -2693,6 +2693,8 @@ static void cmd_strip(struct userrec *u, int idx, char *par)
   /* Set highlight flag here so user is able to control stripping of
    * bold also as intended -- dw 27/12/1999
    */
+  if (!u) /* dunno why, but this really happens -- mortmann */
+    return; /* make eggdrop crash-proof again */
   if (dcc[dest].u.chat->strip_flags & STRIP_BOLD && u->flags & USER_HIGHLITE) {
     u->flags &= ~USER_HIGHLITE;
   } else if (!(dcc[dest].u.chat->strip_flags & STRIP_BOLD) &&

src/misc.c

@@ -190,6 +190,8 @@ int my_strcpy(char *a, const char *b)
 }
 
 /* Split first word off of rest and put it in first
+ *
+ * Please use splitcn() instead
  */
 void splitc(char *first, char *rest, char divider)
 {
@@ -207,14 +209,11 @@ void splitc(char *first, char *rest, char divider)
     memmove(rest, p + 1, strlen(p + 1) + 1);
 }
 
-/*    As above, but lets you specify the 'max' number of bytes (EXCLUDING the
- * terminating null).
+/* As above, but lets you specify the 'max' number of bytes
  *
  * Example of use:
  *
- * char buf[HANDLEN + 1];
- *
- * splitcn(buf, input, "@", HANDLEN);
+ * splitcn(buf, input, '@', sizeof buf);
  *
  * <Cybah>
  */

src/mod/module.h

@@ -528,6 +528,7 @@ typedef void (*chanout_butfunc)(int, int, const char *, ...) ATTRIBUTE_FORMAT(pr
 /* 324 - 327 */
 #define find_member_from_nick ((memberlist * (*) (char *))global[324])
 #define get_user_from_member ((struct userrec * (*) (memberlist *))global[325])
+#define splitcn ((void (*)(char *, char *, char, size_t))global[326])
 
 
 /* hostmasking */

src/modules.c

@@ -626,6 +626,7 @@ Function global_table[] = {
 /* 324 - 327 */
   (Function) find_member_from_nick,
   (Function) get_user_from_member,
+  (Function) splitcn,
 };
 
 void init_modules(void)

src/tcldcc.c

@@ -1353,8 +1353,7 @@ static int tcl_boot STDVAR
   if (strchr(who, '@') != NULL) {
     char whonick[HANDLEN + 1];
 
-    splitc(whonick, who, '@');
-    whonick[HANDLEN] = 0;
+    splitcn(whonick, who, '@', sizeof whonick);
     if (!strcasecmp(who, botnetnick))
       strlcpy(who, whonick, sizeof who);
     else if (remote_boots > 0) {