SECURITY: Fixed a message handling bug which could crash the daemon.

[ngircd-alex.git] / src / ngircd / conn.c

diff --git a/src/ngircd/conn.c b/src/ngircd/conn.c
index decfeb684ef26b7027b6758c9e003ae65bf1bc0d..2e23ade8e8bf406a7c2c2f3771e8fe17abc1fce6 100644 (file)
--- a/src/ngircd/conn.c
+++ b/src/ngircd/conn.c
@@ -1238,7 +1238,7 @@ static void
 Handle_Buffer(CONN_ID Idx)
 {
 #ifndef STRICT_RFC
-       char *ptr1, *ptr2;
+       char *ptr1, *ptr2, *first_eol;
 #endif
        char *ptr;
        size_t len, delta;
@@ -1280,19 +1280,28 @@ Handle_Buffer(CONN_ID Idx)
                ptr = strstr(array_start(&My_Connections[Idx].rbuf), "\r\n");
 
 #ifndef STRICT_RFC
-               if (!ptr) {
-                       /* Check for non-RFC-compliant request (only CR or
-                        * LF)? Unfortunately, there are quite a few clients
-                        * out there that do this -- incl. "mIRC" :-( */
-                       delta = 1;
-                       ptr1 = strchr(array_start(&My_Connections[Idx].rbuf), '\r');
-                       ptr2 = strchr(array_start(&My_Connections[Idx].rbuf), '\n');
+               /* Check for non-RFC-compliant request (only CR or LF)?
+                * Unfortunately, there are quite a few clients out there
+                * that do this -- e. g. mIRC, BitchX, and Trillian :-( */
+               ptr1 = strchr(array_start(&My_Connections[Idx].rbuf), '\r');
+               ptr2 = strchr(array_start(&My_Connections[Idx].rbuf), '\n');
+               if (ptr) {
+                       /* Check if there is a single CR or LF _before_ the
+                        * corerct CR+LF line terminator:  */
+                       first_eol = ptr1 < ptr2 ? ptr1 : ptr2;
+                       if (first_eol < ptr) {
+                               /* Single CR or LF before CR+LF found */
+                               ptr = first_eol;
+                               delta = 1;
+                       }
+               } else if (ptr1 || ptr2) {
+                       /* No CR+LF terminated command found, but single
+                        * CR or LF found ... */
                        if (ptr1 && ptr2)
-                               ptr = ptr1 > ptr2 ? ptr2 : ptr1;
-                       else if (ptr1)
-                               ptr = ptr1;
-                       else if (ptr2)
-                               ptr = ptr2;
+                               ptr = ptr1 < ptr2 ? ptr1 : ptr2;
+                       else
+                               ptr = ptr1 ? ptr1 : ptr2;
+                       delta = 1;
                }
 #endif