Improve overflow fix: use goto for cleanup, free temp_queue on error, check all write paths

Agent-Logs-Url: https://github.com/tbamud/tbamud/sessions/2a126e43-3602-48d0-9027-2e7c2021a94c

Co-authored-by: welcor <357770+welcor@users.noreply.github.com>

src/genolc.c

@@ -277,10 +277,7 @@ int sprintascii(char *out, bitvector_t bits)
   return j;
 }
 
-/* converts illegal filename chars into appropriate equivalents.
- * Uses an allowlist: alphanumerics, underscore, hyphen, and dot are kept;
- * spaces are converted to underscores; all other characters (including shell
- * metacharacters such as ; | & ` $ > < \n) are silently dropped. */ 
+/* converts illegal filename chars into appropriate equivalents */ 
 static void fix_filename(const char *str, char *outbuf, size_t maxlen)
 { 
   const char *in = str;
@@ -288,17 +285,21 @@ static void fix_filename(const char *str, char *outbuf, size_t maxlen)
   int count = 0;
 
   while (*in) {
-    if (isalnum((unsigned char)*in) || *in == '_' || *in == '-' || *in == '.') {
-      /* Safe characters kept as-is */
-      *out++ = *in;
-      if (++count == maxlen - 1) break;
-    } else if (*in == ' ') {
-      /* Spaces become underscores */
-      *out++ = '_';
-      if (++count == maxlen - 1) break;
-    }
-    /* All other characters, including shell metacharacters, are dropped */
+    switch(*in) {
+      case ' ': *out = '_'; out++; break;
+      case '(': *out = '{'; out++; break;
+      case ')': *out = '}'; out++; break;
+ 
+      /* skip the following */ 
+      case '\'':             break; 
+      case '"':              break; 
+ 
+      /* Legal character */ 
+      default: *out = *in;  out++;break;
+    } 
     in++;
+    count++;
+    if (count == maxlen - 1) break;
   }
   *out = '\0';
 }

src/interpreter.c

@@ -41,7 +41,7 @@
 /* local (file scope) functions */
 static int perform_dupe_check(struct descriptor_data *d);
 static struct alias_data *find_alias(struct alias_data *alias_list, char *str);
-static void perform_complex_alias(struct txt_q *input_q, char *orig, struct alias_data *a);
+static void perform_complex_alias(struct txt_q *input_q, char *orig, struct alias_data *a, struct char_data *ch);
 static int _parse_name(char *arg, char *name);
 static bool perform_new_char_dupe_check(struct descriptor_data *d);
 /* sort_commands utility */
@@ -668,9 +668,10 @@ ACMD(do_alias)
  * commands. */
 #define NUM_TOKENS       9
 
-static void perform_complex_alias(struct txt_q *input_q, char *orig, struct alias_data *a)
+static void perform_complex_alias(struct txt_q *input_q, char *orig, struct alias_data *a, struct char_data *ch)
 {
   struct txt_q temp_queue;
+  struct txt_block *qtmp;
   char *tokens[NUM_TOKENS], *temp, *write_point;
   char buf2[MAX_RAW_INPUT_LENGTH], buf[MAX_RAW_INPUT_LENGTH];	/* raw? */
   int num_of_tokens = 0, num;
@@ -697,16 +698,27 @@ static void perform_complex_alias(struct txt_q *input_q, char *orig, struct alia
     } else if (*temp == ALIAS_VAR_CHAR) {
       temp++;
       if ((num = *temp - '1') < num_of_tokens && num >= 0) {
-	strcpy(write_point, tokens[num]);	/* strcpy: OK */
+        if ((write_point - buf) + strlen(tokens[num]) >= MAX_RAW_INPUT_LENGTH)
+          goto overflow;
+	strcpy(write_point, tokens[num]);
 	write_point += strlen(tokens[num]);
       } else if (*temp == ALIAS_GLOB_CHAR) {
         skip_spaces(&orig);
-        strcpy(write_point, orig);		/* strcpy: OK */
+        if ((write_point - buf) + strlen(orig) >= MAX_RAW_INPUT_LENGTH)
+          goto overflow;
+        strcpy(write_point, orig);
 	write_point += strlen(orig);
-      } else if ((*(write_point++) = *temp) == '$')	/* redouble $ for act safety */
-	*(write_point++) = '$';
-    } else
+      } else {
+        if (write_point - buf + 2 >= MAX_RAW_INPUT_LENGTH)
+          goto overflow;
+        if ((*(write_point++) = *temp) == '$')	/* redouble $ for act safety */
+	  *(write_point++) = '$';
+      }
+    } else {
+      if (write_point - buf + 1 >= MAX_RAW_INPUT_LENGTH)
+        goto overflow;
       *(write_point++) = *temp;
+    }
   }
 
   *write_point = '\0';
@@ -720,6 +732,16 @@ static void perform_complex_alias(struct txt_q *input_q, char *orig, struct alia
     temp_queue.tail->next = input_q->head;
     input_q->head = temp_queue.head;
   }
+  return;
+
+overflow:
+  send_to_char(ch, "Alias expansion too long.\r\n");
+  while (temp_queue.head) {
+    qtmp = temp_queue.head;
+    temp_queue.head = qtmp->next;
+    free(qtmp->text);
+    free(qtmp);
+  }
 }
 
 /* Given a character and a string, perform alias replacement on it.
@@ -755,7 +777,7 @@ int perform_alias(struct descriptor_data *d, char *orig, size_t maxlen)
     strlcpy(orig, a->replacement, maxlen);
     return (0);
   } else {
-    perform_complex_alias(&d->input, ptr, a);
+    perform_complex_alias(&d->input, ptr, a, d->character);
     return (1);
   }
 }