Fix unbounded strcpy of password from player file (use strncpy with MAX_PWD_LENGTH)

Agent-Logs-Url: https://github.com/tbamud/tbamud/sessions/28ad1d51-d776-4038-a489-db00dc08e5ff

Co-authored-by: welcor <357770+welcor@users.noreply.github.com>

src/dg_variables.c

@@ -1636,13 +1636,6 @@ void var_subst(void *go, struct script_data *sc, trig_data *trig,
   int paren_count = 0;
   int dots = 0;
 
-  /* reject lines that would overflow our fixed-size buffers */
-  if (strnlen(line, MAX_INPUT_LENGTH) >= MAX_INPUT_LENGTH) {
-    script_log("Trigger VNum %d: variable substitution line too long, ignoring.", GET_TRIG_VNUM(trig));
-    *buf = '\0';
-    return;
-  }
-
   /* skip out if no %'s */
   if (!strchr(line, '%')) {
     strcpy(buf, line);

src/players.c

@@ -405,7 +405,7 @@ int load_char(const char *name, struct char_data *ch)
 
       case 'P':
        if (!strcmp(tag, "Page"))  GET_PAGE_LENGTH(ch) = atoi(line);
-	else if (!strcmp(tag, "Pass"))	strcpy(GET_PASSWD(ch), line);
+	else if (!strcmp(tag, "Pass")) { strncpy(GET_PASSWD(ch), line, MAX_PWD_LENGTH); GET_PASSWD(ch)[MAX_PWD_LENGTH] = '\0'; }
 	else if (!strcmp(tag, "Plyd"))	ch->player.time.played	= atoi(line);
 	else if (!strcmp(tag, "PfIn"))	POOFIN(ch)		= strdup(line);
 	else if (!strcmp(tag, "PfOt"))	POOFOUT(ch)		= strdup(line);