Fix fscanf width specifiers in copyover_recover() to prevent buffer overflow

Agent-Logs-Url: https://github.com/tbamud/tbamud/sessions/82069e78-2bd9-4ff9-9053-0d47dfae5193

Co-authored-by: welcor <357770+welcor@users.noreply.github.com>

src/comm.c

@@ -415,7 +415,7 @@ void copyover_recover()
 
   for (;;) {
     fOld = TRUE;
-    if (fscanf(fp, "%d %ld %s %s %s\n", &desc, &pref, name, host, guiopt) != 5) {
+    if (fscanf(fp, "%d %ld %511s %1023s %1023s\n", &desc, &pref, name, host, guiopt) != 5) {
       if(!feof(fp)) {
         if(ferror(fp))
           log("SYSERR: error reading copyover file %s: %s", COPYOVER_FILE, strerror(errno));

src/genolc.c

@@ -277,10 +277,7 @@ int sprintascii(char *out, bitvector_t bits)
   return j;
 }
 
-/* converts illegal filename chars into appropriate equivalents.
+/* converts illegal filename chars into appropriate equivalents */ 
- * Uses an allowlist: alphanumerics, underscore, hyphen, and dot are kept;
- * spaces are converted to underscores; all other characters (including shell
- * metacharacters such as ; | & ` $ > < \n) are silently dropped. */ 
 static void fix_filename(const char *str, char *outbuf, size_t maxlen)
 { 
   const char *in = str;
@@ -288,17 +285,21 @@ static void fix_filename(const char *str, char *outbuf, size_t maxlen)
   int count = 0;
 
   while (*in) {
-    if (isalnum((unsigned char)*in) || *in == '_' || *in == '-' || *in == '.') {
+    switch(*in) {
-      /* Safe characters kept as-is */
+      case ' ': *out = '_'; out++; break;
-      *out++ = *in;
+      case '(': *out = '{'; out++; break;
-      if (++count == maxlen - 1) break;
+      case ')': *out = '}'; out++; break;
-    } else if (*in == ' ') {
+ 
-      /* Spaces become underscores */
+      /* skip the following */ 
-      *out++ = '_';
+      case '\'':             break; 
-      if (++count == maxlen - 1) break;
+      case '"':              break; 
-    }
+ 
-    /* All other characters, including shell metacharacters, are dropped */
+      /* Legal character */ 
+      default: *out = *in;  out++;break;
+    } 
     in++;
+    count++;
+    if (count == maxlen - 1) break;
   }
   *out = '\0';
 }