- fix potential exploits (reported by kcwu)

git-svn-id: http://opensvn.csie.org/pttbbs/trunk/pttbbs@3795 63ad8ddf-47c3-0310-b6dd-a9e9d9715204

1 files changed, 15 insertions, 2 deletions

diff --git a/mbbsd/screen.c b/mbbsd/screen.c
index 88696f8a..ffd5029b 100644
--- a/mbbsd/screen.c
+++ b/mbbsd/screen.c
@@ -53,8 +53,12 @@ resizeterm(int w, int h)
 void
 move(int y, int x)
 {
-    assert(y>=0);
-    assert(x>=0);
+    if (y < 0) y = 0;
+    if (y >= t_lines) y = t_lines -1;
+    if (x < 0) x = 0;
+    if (x >= ANSILINELEN) x = ANSILINELEN -1;
+    // assert(y>=0);
+    // assert(x>=0);
     cur_col = x;
     cur_ln = y;
 }
@@ -64,6 +68,11 @@ move_ansi(int y, int x)
 {
     // take ANSI length in consideration
     register screenline_t *slp;
+    if (y < 0) y = 0;
+    if (y >= t_lines) y = t_lines -1;
+    if (x < 0) x = 0;
+    if (x >= ANSILINELEN) x = ANSILINELEN -1;
+
     cur_ln = y;
     cur_col = x;
 
@@ -385,6 +394,10 @@ outc(unsigned char c)
     register screenline_t *slp = GetCurrentLine();
     register int    i;
 
+    // 0xFF is invalid for most cases (even DBCS), 
+    if (c == 0xFF || c == 0x00)
+	return;
+
     if (c == '\n' || c == '\r') {
 	if (standing) {
 	    slp->eso = MAX(slp->eso, cur_col);