Fixed NICK_CHANGE buffer overflow

diff --git a/CHANGES b/CHANGES
index c5f1ab5111d546ea09568ecaad423ac39a62ea4f..c9aa3464e236908b9d4397384b1a3f7f4a906c4c 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,12 @@
+Mon Jul  2 17:28:47 CEST 2007  Pekka Riikonen <priikone@silcnet.org>
+
+       * In silc_client_free check that scheduler is allocated before
+         trying to free it.  Affected file is lib/silcclient/client.c.
+
+       * Fixed buffer overflow in NICK_CHANGE notify.  The destination
+         buffer for old nickname was too small.  Affected file is
+         lib/silclient/client_notify.c.
+
 Sun Jul  1 19:15:15 EEST 2007  Pekka Riikonen <priikone@silcnet.org>
 
        * SILC Server 1.1 Beta1.

diff --git a/lib/silcclient/client_entry.c b/lib/silcclient/client_entry.c
index 0c812de00adbd6bec3672098d5b4565e334c52f3..488acfd3b804e5cb016073fe35b47e37b6fadfd8 100644 (file)
--- a/lib/silcclient/client_entry.c
+++ b/lib/silcclient/client_entry.c
@@ -1281,6 +1281,7 @@ SilcClientEntry silc_client_nickname_format(SilcClient client,
   }
 
   newnick[off] = 0;
+  memset(client_entry->nickname, 0, sizeof(client_entry->nickname));
   memcpy(client_entry->nickname, newnick, strlen(newnick));
   silc_client_list_free(client, conn, clients);
 

diff --git a/lib/silcclient/client_notify.c b/lib/silcclient/client_notify.c
index 005299c61f1a0610c9a3186c8c939f471ed5aca1..5d431954d602b0882b0583d64b746451812b4b87 100644 (file)
--- a/lib/silcclient/client_notify.c
+++ b/lib/silcclient/client_notify.c
@@ -690,7 +690,7 @@ SILC_FSM_STATE(silc_client_notify_nick_change)
   SilcNotifyType type = silc_notify_get_type(payload);
   SilcArgumentPayload args = silc_notify_get_args(payload);
   SilcClientEntry client_entry = NULL;
-  unsigned char *tmp, oldnick[128 + 1];
+  unsigned char *tmp, oldnick[256 + 1];
   SilcUInt32 tmp_len;
   SilcID id, id2;
   SilcBool valid;