From a5d15e224c94d44f3cc11a802cc6c10a6086fdb4 Mon Sep 17 00:00:00 2001 From: Dmitry Podgorny Date: Sat, 17 Jul 2021 19:33:28 +0300 Subject: [PATCH 1/2] Fix buffer overread in _mucwin_print_mention() Offset for g_utf8_substring() is higher than the string length. We can avoid g_utf8_substring() for the tail and simply convert starting offset to a pointer. --- src/ui/mucwin.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/ui/mucwin.c b/src/ui/mucwin.c index 54778acb..20d3025b 100644 --- a/src/ui/mucwin.c +++ b/src/ui/mucwin.c @@ -389,7 +389,7 @@ _mucwin_print_mention(ProfWin* window, const char* const message, const char* co while (curr) { pos = GPOINTER_TO_INT(curr->data); - char *before_str = g_utf8_substring(message, last_pos, last_pos + pos - last_pos); + char *before_str = g_utf8_substring(message, last_pos, pos); if (strncmp(before_str, "/me ", 4) == 0) { win_print_them(window, THEME_ROOMMENTION, ch, flags, ""); @@ -416,9 +416,9 @@ _mucwin_print_mention(ProfWin* window, const char* const message, const char* co glong message_len = g_utf8_strlen(message, -1); if (last_pos < message_len) { - char* rest = g_utf8_substring(message, last_pos, last_pos + message_len); + // get tail without allocating a new string + char* rest = g_utf8_offset_to_pointer(message, last_pos); win_appendln_highlight(window, THEME_ROOMMENTION, "%s", rest); - g_free(rest); } else { win_appendln_highlight(window, THEME_ROOMMENTION, ""); } From c0ea27f2f0c6f086ff88a212809f5b695345a029 Mon Sep 17 00:00:00 2001 From: Dmitry Podgorny Date: Sat, 17 Jul 2021 19:36:31 +0300 Subject: [PATCH 2/2] Don't handle /me in the middle of a message with mentions --- src/ui/mucwin.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/ui/mucwin.c b/src/ui/mucwin.c index 20d3025b..a0717282 100644 --- a/src/ui/mucwin.c +++ b/src/ui/mucwin.c @@ -386,12 +386,14 @@ _mucwin_print_mention(ProfWin* window, const char* const message, const char* co int last_pos = 0; int pos; GSList* curr = mentions; + glong mynick_len = g_utf8_strlen(mynick, -1); + while (curr) { pos = GPOINTER_TO_INT(curr->data); char *before_str = g_utf8_substring(message, last_pos, pos); - if (strncmp(before_str, "/me ", 4) == 0) { + if (last_pos == 0 && strncmp(before_str, "/me ", 4) == 0) { win_print_them(window, THEME_ROOMMENTION, ch, flags, ""); win_append_highlight(window, THEME_ROOMMENTION, "*%s ", from); win_append_highlight(window, THEME_ROOMMENTION, "%s", before_str + 4); @@ -404,7 +406,6 @@ _mucwin_print_mention(ProfWin* window, const char* const message, const char* co } g_free(before_str); - glong mynick_len = g_utf8_strlen(mynick, -1); char* mynick_str = g_utf8_substring(message, pos, pos + mynick_len); win_append_highlight(window, THEME_ROOMMENTION_TERM, "%s", mynick_str); g_free(mynick_str);