projects / silc.git / blobdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | inline | side by side
Fixed string format vulnerability in client entry handling.
[silc.git] / lib / silcclient / client_entry.c
diff --git a/lib/silcclient/client_entry.c b/lib/silcclient/client_entry.c
index 4664dbaa75f770446b457b8b7d830b67cab2d524..c950bfb283ee032029b1663d0419d383a783b986 100644 (file)
--- a/lib/silcclient/client_entry.c
+++ b/lib/silcclient/client_entry.c
@@ -4,7 +4,7 @@
 
   Author: Pekka Riikonen <priikone@silcnet.org>
 
-  Copyright (C) 2001 - 2007 Pekka Riikonen
+  Copyright (C) 2001 - 2008 Pekka Riikonen
 
   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
@@ -801,10 +801,10 @@ SilcClientEntry silc_client_add_client(SilcClient client,
                      client_entry->server, sizeof(client_entry->server));
   if (nickname && client->internal->params->full_nicknames)
     silc_snprintf(client_entry->nickname, sizeof(client_entry->nickname),
-                 nickname);
+                 "%s", nickname);
   else if (nickname)
     silc_snprintf(client_entry->nickname, sizeof(client_entry->nickname),
-                 parsed);
+                 "%s", parsed);
 
   silc_parse_userfqdn(username, client_entry->username,
                      sizeof(client_entry->username),
@@ -815,6 +815,9 @@ SilcClientEntry silc_client_add_client(SilcClient client,
                                                 NULL, NULL, NULL, TRUE);
   if (!client_entry->channels) {
     silc_free(client_entry->realname);
+    silc_atomic_uninit32(&client_entry->internal.deleted);
+    silc_atomic_uninit32(&client_entry->internal.refcnt);
+    silc_rwlock_free(client_entry->internal.lock);
     silc_free(client_entry);
     return NULL;
   }
@@ -824,8 +827,11 @@ SilcClientEntry silc_client_add_client(SilcClient client,
     nick = silc_identifier_check(parsed, strlen(parsed),
                                 SILC_STRING_UTF8, 128, NULL);
     if (!nick) {
-      silc_free(client_entry->realname);
       silc_hash_table_free(client_entry->channels);
+      silc_free(client_entry->realname);
+      silc_atomic_uninit32(&client_entry->internal.deleted);
+      silc_atomic_uninit32(&client_entry->internal.refcnt);
+      silc_rwlock_free(client_entry->internal.lock);
       silc_free(client_entry);
       return NULL;
     }
@@ -837,8 +843,11 @@ SilcClientEntry silc_client_add_client(SilcClient client,
   if (!silc_idcache_add(conn->internal->client_cache, nick,
                        &client_entry->id, client_entry)) {
     silc_free(nick);
-    silc_free(client_entry->realname);
     silc_hash_table_free(client_entry->channels);
+    silc_free(client_entry->realname);
+    silc_atomic_uninit32(&client_entry->internal.deleted);
+    silc_atomic_uninit32(&client_entry->internal.refcnt);
+    silc_rwlock_free(client_entry->internal.lock);
     silc_free(client_entry);
     silc_mutex_unlock(conn->internal->lock);
     return NULL;
@@ -891,10 +900,10 @@ void silc_client_update_client(SilcClient client,
                        client_entry->server, sizeof(client_entry->server));
     if (client->internal->params->full_nicknames)
       silc_snprintf(client_entry->nickname, sizeof(client_entry->nickname),
-                   nickname);
+                   "%s", nickname);
     else
       silc_snprintf(client_entry->nickname, sizeof(client_entry->nickname),
-                   parsed);
+                   "%s", parsed);
 
     /* Normalize nickname */
     nick = silc_identifier_check(parsed, strlen(parsed),
@@ -1010,10 +1019,10 @@ SilcBool silc_client_del_client(SilcClient client, SilcClientConnection conn,
   if (!client_entry)
     return FALSE;
 
-  SILC_LOG_DEBUG(("Marking client entry %p deleted"));
+  SILC_LOG_DEBUG(("Marking client entry %p deleted", client_entry));
 
   if (silc_atomic_sub_int32(&client_entry->internal.deleted, 1) != 0) {
-    SILC_LOG_DEBUG(("Client entry %p already marked deleted"));
+    SILC_LOG_DEBUG(("Client entry %p already marked deleted", client_entry));
     return FALSE;
   }
 
@@ -1197,7 +1206,7 @@ SilcClientEntry silc_client_nickname_format(SilcClient client,
         return NULL;
 
       silc_snprintf(client_entry->nickname, sizeof(client_entry->nickname),
-                   cp);
+                   "%s", cp);
       silc_free(cp);
     }
 
@@ -1652,6 +1661,7 @@ SilcChannelEntry silc_client_add_channel(SilcClient client,
   if (!channel->channel_name) {
     silc_rwlock_free(channel->internal.lock);
     silc_atomic_uninit32(&channel->internal.refcnt);
+    silc_atomic_uninit32(&channel->internal.deleted);
     silc_free(channel);
     return NULL;
   }
@@ -1661,6 +1671,7 @@ SilcChannelEntry silc_client_add_channel(SilcClient client,
   if (!channel->user_list) {
     silc_rwlock_free(channel->internal.lock);
     silc_atomic_uninit32(&channel->internal.refcnt);
+    silc_atomic_uninit32(&channel->internal.deleted);
     silc_free(channel->channel_name);
     silc_free(channel);
     return NULL;
@@ -1672,6 +1683,7 @@ SilcChannelEntry silc_client_add_channel(SilcClient client,
   if (!channel_namec) {
     silc_rwlock_free(channel->internal.lock);
     silc_atomic_uninit32(&channel->internal.refcnt);
+    silc_atomic_uninit32(&channel->internal.deleted);
     silc_free(channel->channel_name);
     silc_hash_table_free(channel->user_list);
     silc_free(channel);
@@ -1685,6 +1697,7 @@ SilcChannelEntry silc_client_add_channel(SilcClient client,
                        &channel->id, channel)) {
     silc_rwlock_free(channel->internal.lock);
     silc_atomic_uninit32(&channel->internal.refcnt);
+    silc_atomic_uninit32(&channel->internal.deleted);
     silc_free(channel_namec);
     silc_free(channel->channel_name);
     silc_hash_table_free(channel->user_list);
@@ -1709,10 +1722,10 @@ SilcBool silc_client_del_channel(SilcClient client, SilcClientConnection conn,
   if (!channel)
     return FALSE;
 
-  SILC_LOG_DEBUG(("Marking channel entry %p deleted"));
+  SILC_LOG_DEBUG(("Marking channel entry %p deleted", channel));
 
   if (silc_atomic_sub_int32(&channel->internal.deleted, 1) != 0) {
-    SILC_LOG_DEBUG(("Channel entry %p already marked deleted"));
+    SILC_LOG_DEBUG(("Channel entry %p already marked deleted", channel));
     return FALSE;
   }
 
@@ -2081,6 +2094,7 @@ SilcServerEntry silc_client_add_server(SilcClient client,
 
   silc_rwlock_alloc(&server_entry->internal.lock);
   silc_atomic_init32(&server_entry->internal.refcnt, 0);
+  silc_atomic_init32(&server_entry->internal.deleted, 1);
   server_entry->id = *server_id;
   if (server_name)
     server_entry->server_name = strdup(server_name);
@@ -2094,6 +2108,9 @@ SilcServerEntry silc_client_add_server(SilcClient client,
     if (!server_namec) {
       silc_free(server_entry->server_name);
       silc_free(server_entry->server_info);
+      silc_atomic_uninit32(&server_entry->internal.deleted);
+      silc_atomic_uninit32(&server_entry->internal.refcnt);
+      silc_rwlock_free(server_entry->internal.lock);
       silc_free(server_entry);
       return NULL;
     }
@@ -2107,6 +2124,9 @@ SilcServerEntry silc_client_add_server(SilcClient client,
     silc_free(server_namec);
     silc_free(server_entry->server_name);
     silc_free(server_entry->server_info);
+    silc_atomic_uninit32(&server_entry->internal.deleted);
+    silc_atomic_uninit32(&server_entry->internal.refcnt);
+    silc_rwlock_free(server_entry->internal.lock);
     silc_free(server_entry);
     silc_mutex_unlock(conn->internal->lock);
     return NULL;
@@ -2125,37 +2145,14 @@ SilcServerEntry silc_client_add_server(SilcClient client,
 SilcBool silc_client_del_server(SilcClient client, SilcClientConnection conn,
                                SilcServerEntry server)
 {
-  SilcIDCacheEntry id_cache;
-  SilcBool ret = TRUE;
-  char *namec;
-
   if (!server)
     return FALSE;
 
-  if (silc_atomic_sub_int32(&server->internal.refcnt, 1) > 0)
+  if (silc_atomic_sub_int32(&server->internal.deleted, 1) != 0)
     return FALSE;
 
-  SILC_LOG_DEBUG(("Deleting server %p", server));
-
-  silc_mutex_lock(conn->internal->lock);
-  if (silc_idcache_find_by_context(conn->internal->server_cache, server,
-                                  &id_cache)) {
-    namec = id_cache->name;
-    ret = silc_idcache_del_by_context(conn->internal->server_cache,
-                                     server, NULL);
-    silc_free(namec);
-  }
-  silc_mutex_unlock(conn->internal->lock);
-
-  silc_free(server->server_name);
-  silc_free(server->server_info);
-  if (server->public_key)
-    silc_pkcs_public_key_free(server->public_key);
-  silc_atomic_uninit32(&server->internal.refcnt);
-  silc_rwlock_free(server->internal.lock);
-  silc_free(server);
-
-  return ret;
+  silc_client_unref_server(client, conn, server);
+  return TRUE;
 }
 
 /* Updates the `server_entry' with the new information sent as argument. */
@@ -2231,13 +2228,36 @@ SilcServerEntry silc_client_ref_server(SilcClient client,
 void silc_client_unref_server(SilcClient client, SilcClientConnection conn,
                              SilcServerEntry server_entry)
 {
-  if (server_entry) {
-    SILC_LOG_DEBUG(("Server %p refcnt %d->%d", server_entry,
-                   silc_atomic_get_int32(&server_entry->internal.refcnt),
-                   silc_atomic_get_int32(&server_entry->internal.refcnt)
-                   - 1));
-    silc_client_del_server(client, conn, server_entry);
+  SilcBool ret;
+  SilcIDCacheEntry id_cache;
+  char *namec;
+
+  if (!server_entry)
+    return;
+
+  if (silc_atomic_sub_int32(&server_entry->internal.refcnt, 1) > 0)
+    return;
+
+  SILC_LOG_DEBUG(("Deleting server %p", server_entry));
+
+  silc_mutex_lock(conn->internal->lock);
+  if (silc_idcache_find_by_context(conn->internal->server_cache, server_entry,
+                                  &id_cache)) {
+    namec = id_cache->name;
+    ret = silc_idcache_del_by_context(conn->internal->server_cache,
+                                     server_entry, NULL);
+    silc_free(namec);
   }
+  silc_mutex_unlock(conn->internal->lock);
+
+  silc_free(server_entry->server_name);
+  silc_free(server_entry->server_info);
+  if (server_entry->public_key)
+    silc_pkcs_public_key_free(server_entry->public_key);
+  silc_atomic_uninit32(&server_entry->internal.deleted);
+  silc_atomic_uninit32(&server_entry->internal.refcnt);
+  silc_rwlock_free(server_entry->internal.lock);
+  silc_free(server_entry);
 }
 
 /* Free server entry list */
SILC - Secure Internet Live Conferencing