take care of buffer size, try to avoid crash.

git-svn-id: http://opensvn.csie.org/pttbbs/trunk/pttbbs@3060 63ad8ddf-47c3-0310-b6dd-a9e9d9715204

1 files changed, 33 insertions, 19 deletions

diff --git a/util/buildAnnounce.c b/util/buildAnnounce.c
index be1b4ad4..9f170cc6 100644
--- a/util/buildAnnounce.c
+++ b/util/buildAnnounce.c
@@ -11,24 +11,32 @@ int cmpboardclass(const void *a, const void *b)
     boardheader_t **brd = (boardheader_t **)a;
     boardheader_t **tmp = (boardheader_t **)b;
     return (strncmp((*brd)->title, (*tmp)->title, 4)<<8)+
-	   strcasecmp((*brd)->brdname, (*tmp)->brdname);
+	   strncasecmp((*brd)->brdname, (*tmp)->brdname, IDLEN);
 } 
 void buildchilds(int level,char *path,int gid)
 {
     char newpath[512];
     int i,count=0;
-    boardheader_t *ptr, *selected[512];
+    boardheader_t *ptr, **selected=NULL;
     fileheader_t item;
+    char *p;
+    int preserved=32;
+    selected=malloc(preserved * sizeof(boardheader_t*));
     
-    for(i=0; i<numboards;  i++)
-    {
+    /* XXX It will cost O(ngroup * numboards) totally. */
+    for(i=0; i<numboards;  i++) {
         ptr =&SHM->bcache[i];
-	if(
-           ptr->gid != gid ||
-	   (ptr->brdattr&(BRD_BAD | BRD_HIDE))!=0
-	   ||
-	   (ptr->level && !(ptr->brdattr & BRD_POSTMASK)))
+	if(ptr->gid != gid)
+	    continue;
+	if((ptr->brdattr&(BRD_BAD | BRD_HIDE))!=0)
 	    continue;
+	if((ptr->level && !(ptr->brdattr & BRD_POSTMASK)))
+	    continue;
+	if(count==preserved) {
+	    preserved*=2;
+	    selected=(boardheader_t**)realloc(selected, preserved*sizeof(boardheader_t*));
+	}
+	assert(selected);
         selected[count++]=ptr;
     }       
     qsort(&selected, count, sizeof(boardheader_t *),
@@ -40,24 +48,30 @@ void buildchilds(int level,char *path,int gid)
 	       ptr->brdname, ptr->title);
 
         if(ptr->brdattr & BRD_GROUPBOARD){
-	    sprintf(newpath,"%s/%s",path,ptr->brdname);
+	    snprintf(newpath,sizeof(newpath),"%s/%s",path,ptr->brdname);
 	    mkdir(newpath,0766);
 	    buildchilds(level+1,newpath,ptr-bcache+1); 
 	}
 	else{
-	    sprintf(newpath,"/bin/ln -s "BBSHOME"/man/boards/%c/%s %s/%s",
-		    /* maybe something wrong with this             ^^^^^ */
-		    ptr->brdname[0], ptr->brdname,path,ptr->brdname);
-	    system(newpath);
+	    if(!invalid_pname(path) && !invalid_pname(ptr->brdname) &&
+		    isalpha(ptr->brdname[0])) {
+		sprintf(newpath,"/bin/ln -s "BBSHOME"/man/boards/%c/%s %s/%s",
+			ptr->brdname[0], ptr->brdname,path,ptr->brdname);
+		system(newpath);
+	    } else {
+		printf("something wrong: %s, %s\n",path, ptr->brdname);
+	    }
 	}
-        strcpy(item.owner,ptr->BM);
-	strtok(item.owner,"/");
-        sprintf(item.title,"%-13.13s %-32.32s", level?ptr->brdname:"", ptr->title+7);
+        strlcpy(item.owner,ptr->BM, sizeof(item.owner));
+	if((p=strchr(item.owner,'/'))!=NULL)
+	    *p='\0';
+        snprintf(item.title,sizeof(item.title),"%-13.13s %-32.32s", level?ptr->brdname:"", ptr->title+7);
         item.filemode =  0 ;
-        sprintf(item.filename,ptr->brdname);
-        sprintf(newpath,"%s/.DIR",path);
+	strlcpy(item.filename,ptr->brdname,sizeof(item.filename));
+        snprintf(newpath,sizeof(newpath),"%s/.DIR",path);
 	append_record(newpath, &item, sizeof(item));
     }
+    free(selected);
 }