updates.

diff --git a/CHANGES b/CHANGES
index b22ea6689ba3f2661df503996b24e3d207770665..9e449d75943a0aa11284a90c47ff6139a677f9fb 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,11 @@
+Fri Apr 20 18:58:43 EEST 2001  Pekka Riikonen <priikone@poseidon.pspt.fi>
+
+       * Fixed buffer overflow in silc_string_compare in the file
+         lib/silcutil/silcutil.c.
+
+       * Fixed double free in silc_server_command_leave in the file
+         silcd/command.c.
+
 Fri Apr 20 14:00:11 EEST 2001  Pekka Riikonen <priikone@poseidon.pspt.fi>
 
        * Fixed the version checking in the server.  Affected file is

diff --git a/apps/silcd/command.c b/apps/silcd/command.c
index f2d0f42c2e28a965f6536077f57ca651172cd66d..96c64430bc1b759e05c59fd2ae89ffd4dce9a5a4 100644 (file)
--- a/apps/silcd/command.c
+++ b/apps/silcd/command.c
@@ -4661,8 +4661,6 @@ SILC_SERVER_CMD_FUNC(leave)
                                 FALSE : !server->standalone);
   }
 
-  silc_free(id);
-
  out:
   if (id)
     silc_free(id);

diff --git a/apps/silcd/server.c b/apps/silcd/server.c
index 4892cd065864cae453981326a1b592d73dc6438b..7982f239e456ac5df058e82a7c86e7b005ea379c 100644 (file)
--- a/apps/silcd/server.c
+++ b/apps/silcd/server.c
@@ -1521,7 +1521,7 @@ SILC_TASK_CALLBACK(silc_server_packet_parse_real)
     if (client && client->id) {
       void *id = silc_id_str2id(packet->src_id, packet->src_id_len,
                                packet->src_id_type);
-      if (SILC_ID_CLIENT_COMPARE(client->id, id)) {
+      if (!id || SILC_ID_CLIENT_COMPARE(client->id, id)) {
        silc_free(id);
        goto out;
       }

diff --git a/lib/silcutil/silcutil.c b/lib/silcutil/silcutil.c
index 2f0f69e00af6ef2286a5601538d88dec1def4e2e..36668b3571d5ec613c96062e454e108e72bbf42a 100644 (file)
--- a/lib/silcutil/silcutil.c
+++ b/lib/silcutil/silcutil.c
@@ -555,7 +555,7 @@ int silc_string_compare(char *string1, char *string2)
   tmpstr2 = silc_calloc(slen2 + 1, sizeof(char));
   memcpy(tmpstr2, string2, slen2);
   
-  for (i = 0; i < slen2; i++) {
+  for (i = 0; i < slen1; i++) {
     
     /* * wildcard. Only one * wildcard is possible. */
     if (tmpstr1[i] == '*')
@@ -576,11 +576,6 @@ int silc_string_compare(char *string1, char *string2)
        if (!(slen1 < slen2))
          tmpstr2[i] = '?';
       }
-#if 0
-    } else {
-      if (strncmp(tmpstr1, tmpstr2, i))
-       strncpy(tmpstr2, string2, slen2);
-#endif
     }
   }