SECURITY: Fixed a message handling bug which could crash the daemon.

[ngircd-alex.git] / src / ngircd / parse.c

diff --git a/src/ngircd/parse.c b/src/ngircd/parse.c
index 5cfeaaa8a9fa05ba1c5e81a5cf612c6bb77c23d1..493fbdc0d500336714393ea4917002c6ff5fec43 100644 (file)
--- a/src/ngircd/parse.c
+++ b/src/ngircd/parse.c
@@ -1,6 +1,6 @@
 /*
  * ngIRCd -- The Next Generation IRC Daemon
- * Copyright (c)2001,2002 by Alexander Barton (alex@barton.de)
+ * Copyright (c)2001-2008 Alexander Barton (alex@barton.de)
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -9,11 +9,8 @@
  * Please read the file COPYING, README and AUTHORS for more information.
  */
 
-
 #include "portab.h"
 
-static char UNUSED id[] = "$Id: parse.c,v 1.72 2008/02/17 13:26:42 alex Exp $";
-
 /**
  * @file
  * IRC command parser and validator.
@@ -92,6 +89,9 @@ static COMMAND My_Commands[] =
        { "REHASH", IRC_REHASH, CLIENT_USER, 0, 0, 0 },
        { "RESTART", IRC_RESTART, CLIENT_USER, 0, 0, 0 },
        { "SERVER", IRC_SERVER, 0xFFFF, 0, 0, 0 },
+       { "SERVICE", IRC_SERVICE, 0xFFFF, 0, 0, 0 },
+       { "SERVLIST", IRC_SERVLIST, CLIENT_USER, 0, 0, 0 },
+       { "SQUERY", IRC_SQUERY, CLIENT_USER|CLIENT_SERVER, 0, 0, 0 },
        { "SQUIT", IRC_SQUIT, CLIENT_SERVER, 0, 0, 0 },
        { "STATS", IRC_STATS, CLIENT_USER|CLIENT_SERVER, 0, 0, 0 },
        { "SUMMON", IRC_SUMMON, CLIENT_USER|CLIENT_SERVER, 0, 0, 0 },
@@ -338,11 +338,39 @@ Validate_Command( UNUSED CONN_ID Idx, UNUSED REQUEST *Req, bool *Closed )
 
 
 static bool
-Validate_Args( UNUSED CONN_ID Idx, UNUSED REQUEST *Req, bool *Closed )
+#ifdef STRICT_RFC
+Validate_Args(CONN_ID Idx, REQUEST *Req, bool *Closed)
+#else
+Validate_Args(UNUSED CONN_ID Idx, UNUSED REQUEST *Req, bool *Closed)
+#endif
 {
+#ifdef STRICT_RFC
+       int i;
+#endif
+
+       *Closed = false;
+
+#ifdef STRICT_RFC
        assert( Idx >= 0 );
        assert( Req != NULL );
-       *Closed = false;
+
+       /* CR and LF are never allowed in command parameters.
+        * But since we do accept lines terminated only with CR or LF in
+        * "non-RFC-compliant mode" (besides the correct CR+LF combination),
+        * this check can only trigger in "strict RFC" mode; therefore we
+        * optimize it away otherwise ... */
+       for (i = 0; i < Req->argc; i++) {
+               if (strchr(Req->argv[i], '\r') || strchr(Req->argv[i], '\n')) {
+                       Log(LOG_ERR,
+                           "Invalid character(s) in parameter (connection %d, command %s)!?",
+                           Idx, Req->command);
+                       if (!Conn_WriteStr(Idx,
+                                          "ERROR :Invalid character(s) in parameter!"))
+                               *Closed = true;
+                       return false;
+               }
+       }
+#endif
 
        return true;
 } /* Validate_Args */