Changeset 1252 for cacamoo/trunk


Ignore:
Timestamp:
Oct 28, 2006, 11:00:58 AM (14 years ago)
Author:
Sam Hocevar
Message:
  • Fixed buffer overflow in replace().
File:
1 edited

Legend:

Unmodified
Added
Removed
  • cacamoo/trunk/src/main.c

    r1251 r1252  
    324324    unsigned int s = 0;
    325325    char *temp = NULL;
    326     char *temp2 = NULL;
    327326
    328327    /* Try direct name */
     
    373372
    374373    /* AHAHAH, THAT'S A COOL PERL INTERPRETER ! */
    375     temp2 = replace(temp, " = <<\"EOC\";", "");
    376     if(temp!=temp2 && temp2 !=NULL)
    377     {
    378         free(temp);
    379         temp = temp2;
    380     }
    381     temp2 = replace(temp, " = <<EOC;"    , "");
    382     if(temp!=temp2 && temp2 !=NULL)
    383     {
    384         free(temp);
    385         temp = temp2;
    386     }
    387     temp2 = replace(temp, " = <<EOC"     , "");
    388     if(temp!=temp2 && temp2 !=NULL)
    389     {
    390         free(temp);
    391         temp = temp2;
    392     }
    393     temp2 = replace(temp, " = << EOC"    , "");
    394     if(temp!=temp2 && temp2 !=NULL)
    395     {
    396         free(temp);
    397         temp = temp2;
    398     }
    399     temp2 = replace(temp, "EOC"          , "");
    400     if(temp!=temp2 && temp2 !=NULL)
    401     {
    402         free(temp);
    403         temp = temp2;
    404     }
    405     temp2 = replace(temp, "$eyes"        , cacamoo_use_eyes);
    406     if(temp!=temp2 && temp2 !=NULL)
    407     {
    408         free(temp);
    409         temp = temp2;
    410     }
    411     temp2 = replace(temp, "${eyes}"      , cacamoo_use_eyes);
    412     if(temp!=temp2 && temp2 !=NULL)
    413     {
    414         free(temp);
    415         temp = temp2;
    416     }
    417     temp2 = replace(temp, "$tongue"      , cacamoo_use_tongue);
    418     if(temp!=temp2 && temp2 !=NULL)
    419     {
    420         free(temp);
    421         temp = temp2;
    422     }
    423     temp2 = replace(temp, "${tongue}"    , cacamoo_use_tongue);
    424     if(temp!=temp2 && temp2 !=NULL)
    425     {
    426         free(temp);
    427         temp = temp2;
    428     }
    429     temp2 = replace(temp, "$thoughts"    , cacamoo_thoughts);
    430     if(temp!=temp2 && temp2 !=NULL)
    431     {
    432         free(temp);
    433         temp = temp2;
    434     }
    435     temp2 = replace(temp, "${thoughts}"  , cacamoo_thoughts);
    436     if(temp!=temp2 && temp2 !=NULL)
    437     {
    438         free(temp);
    439         temp = temp2;
    440     }
    441     temp2 = replace(temp, "$the_cow"     , (const char*)string);
    442     if(temp!=temp2 && temp2 !=NULL)
    443     {
    444         free(temp);
    445         temp = temp2;
    446     }
    447     temp2 = replace(temp, "${the_cow}"   , (const char*)string);
    448     if(temp!=temp2 && temp2 !=NULL)
    449     {
    450         free(temp);
    451         temp = temp2;
    452     }
     374    temp = replace(temp, " = <<\"EOC\";", "");
     375    temp = replace(temp, " = <<EOC;"    , "");
     376    temp = replace(temp, " = <<EOC"     , "");
     377    temp = replace(temp, " = << EOC"    , "");
     378    temp = replace(temp, "EOC"          , "");
     379    temp = replace(temp, "$eyes"        , cacamoo_use_eyes);
     380    temp = replace(temp, "${eyes}"      , cacamoo_use_eyes);
     381    temp = replace(temp, "$tongue"      , cacamoo_use_tongue);
     382    temp = replace(temp, "${tongue}"    , cacamoo_use_tongue);
     383    temp = replace(temp, "$thoughts"    , cacamoo_thoughts);
     384    temp = replace(temp, "${thoughts}"  , cacamoo_thoughts);
     385    temp = replace(temp, "$the_cow"     , (const char*)string);
     386    temp = replace(temp, "${the_cow}"   , (const char*)string);
    453387    *size = strlen(temp)+1;
    454 
    455388
    456389    fclose(fp);
     
    510443}
    511444
    512 char *replace(char *str, char *oldpiece, const char *newpiece)
    513 {
    514     int str_index, newstr_index, oldpiece_index, end,
    515         new_len, old_len, cpy_len;
    516     char *c = NULL;
    517     char *newstr = NULL;
    518     char *orig = str;
    519 
    520     if(oldpiece==NULL || newpiece==NULL)
    521         return NULL;
    522 
    523     if ((c = (char *) strstr(str, oldpiece)) == NULL)
    524         return str;
    525 
    526 
    527     newstr = malloc(8192); // FIXME
    528 
    529     if(newstr == NULL)
    530     {
    531         return str;
    532     }
    533 
    534     new_len        = strlen(newpiece);
    535     old_len        = strlen(oldpiece);
    536     end            = strlen(str)   - old_len;
    537     oldpiece_index = c - str;
    538 
    539     newstr_index = 0;
    540     str_index = 0;
    541     while(str_index <= end && c != NULL)
    542     {
    543         /* Copy characters from the left of matched pattern occurence */
    544         cpy_len = oldpiece_index-str_index;
    545         strncpy(newstr+newstr_index, str+str_index, cpy_len);
    546         newstr_index += cpy_len;
    547         str_index    += cpy_len;
    548 
    549         /* Copy replacement characters instead of matched pattern */
    550         strcpy(newstr+newstr_index, newpiece);
    551         newstr_index += new_len;
    552         str_index    += old_len;
    553 
    554         /* Check for another pattern match */
    555         if((c = (char *) strstr(str+str_index, oldpiece)) != NULL)
    556             oldpiece_index = c - str;
    557     }
    558     /* Copy remaining characters from the right of last matched pattern */
    559     strcpy(newstr+newstr_index, str+str_index);
    560 
    561     str = orig;
    562     return newstr;
     445char *replace(char *s1, char *oldpiece, const char *newpiece)
     446{
     447    unsigned int oldlen = strlen(oldpiece), newlen = strlen(newpiece);
     448    unsigned int i1 = 0, i2 = 0;
     449    char *s2 = oldlen < newlen ? NULL : s1;
     450
     451    for(;;)
     452    {
     453        char *found = strstr(s1 + i1, oldpiece);
     454        unsigned int tocopy;
     455
     456        if(!found)
     457        {
     458            tocopy = strlen(s1 + i1);
     459            if(oldlen < newlen)
     460                s2 = realloc(s2, i2 + tocopy + 1);
     461            memmove(s2 + i2, s1 + i1, tocopy + 1);
     462            if(oldlen < newlen)
     463                free(s1);
     464            return s2;
     465        }
     466
     467        tocopy = found - (s1 + i1);
     468        if(oldlen < newlen)
     469            s2 = realloc(s2, i2 + tocopy + newlen);
     470        memmove(s2 + i2, s1 + i1, tocopy);
     471        memcpy(s2 + tocopy, newpiece, newlen);
     472        i1 += tocopy + oldlen;
     473        i2 += tocopy + newlen;
     474    }
    563475}
    564476
Note: See TracChangeset for help on using the changeset viewer.