when botlink() is called with:
linker, idx, bot.
linker which is a string which represented the user who 'started' the linked is passed while the dns resolve AS IS which is dangerous, only after dns resolve is successful linker string is being copied over the dcc memory, only then its safe.
this bug is harmful, only when botlink() is called from bot_link(), which in there 'linker' comes from a line string (from botnet protocol)
I would advise using nmalloc(strlen(linker)+1) and strcpy()
(still using cptr to pass the pointer)
on sucessful dns resolve, copy and free
on failure dns resolve, just free
I have confirmed this bug to exists on bug eggdrop 1.6 and eggdrop 1.7 CVS trees.
--- botnet.c.orig Thu Feb 21 16:33:45 2002
+++ botnet.c Wed Mar 6 09:01:51 2002
@@ -1033,7 +1033,8 @@
strcpy(dcc.nick, nick);
strcpy(dcc.host, bi->address);
dcc.u.dns->ibuf = idx;
- dcc.u.dns->cptr = linker;
+ dcc.u.dns->cptr = get_data_ptr(strlen(linker) + 1);
+ strcpy(dcc.u.dns->cptr, linker);
dcc.u.dns->host = get_data_ptr(strlen(dcc.host) + 1);
strcpy(dcc.u.dns->host, dcc.host);
dcc[i].u.dns->dns_success = botlink_resolve_success;
@@ -1053,6 +1054,7 @@
putlog(LOG_BOTS, "*", DCC_LINKFAIL, dcc[i].nick);
strcpy(s, dcc[i].nick);
+ nfree(dcc[i].u.dns->cptr);
lostdcc(i);
autolink_cycle(s); /* Check for more auto-connections */
}
@@ -1066,6 +1068,7 @@
changeover_dcc(i, &DCC_FORK_BOT, sizeof(struct bot_info));
dcc[i].timeval = now;
strcpy(dcc[i].u.bot->linker, linker);
+ nfree(linker);
strcpy(dcc[i].u.bot->version, "(primitive bot)");
dcc[i].u.bot->numver = idx;
dcc[i].u.bot->port = dcc[i].port; /* Remember where i started */
<font size=-1>[ This Message was edited by: amir on 2002-03-06 02:04 ]</font>