summaryrefslogtreecommitdiffstats
path: root/mbbsd
diff options
context:
space:
mode:
authorscw <scw@63ad8ddf-47c3-0310-b6dd-a9e9d9715204>2004-01-02 15:57:11 +0800
committerscw <scw@63ad8ddf-47c3-0310-b6dd-a9e9d9715204>2004-01-02 15:57:11 +0800
commitf67229f90af4bd3c51c01a13fe713d8ea0766073 (patch)
tree542eb79a50d78091a834efb3fcb5e5fc1b4fc210 /mbbsd
parent5d80d97a28d05f37d4bd5499cd552b65eed167e6 (diff)
downloadpttbbs-f67229f90af4bd3c51c01a13fe713d8ea0766073.tar
pttbbs-f67229f90af4bd3c51c01a13fe713d8ea0766073.tar.gz
pttbbs-f67229f90af4bd3c51c01a13fe713d8ea0766073.tar.bz2
pttbbs-f67229f90af4bd3c51c01a13fe713d8ea0766073.tar.lz
pttbbs-f67229f90af4bd3c51c01a13fe713d8ea0766073.tar.xz
pttbbs-f67229f90af4bd3c51c01a13fe713d8ea0766073.tar.zst
pttbbs-f67229f90af4bd3c51c01a13fe713d8ea0766073.zip
fix msg bound check bug
git-svn-id: http://opensvn.csie.org/pttbbs/trunk/pttbbs@1445 63ad8ddf-47c3-0310-b6dd-a9e9d9715204
Diffstat (limited to 'mbbsd')
-rw-r--r--mbbsd/talk.c14
1 files changed, 8 insertions, 6 deletions
diff --git a/mbbsd/talk.c b/mbbsd/talk.c
index 7aee54f2..df570f38 100644
--- a/mbbsd/talk.c
+++ b/mbbsd/talk.c
@@ -654,15 +654,17 @@ my_write(pid_t pid, char *prompt, char *id, int flag, userinfo_t * puin)
!(fri_stat & HFM))))
outmsg("\033[1;33;41m糟糕! 對方防水了! \033[37m~>_<~\033[m");
else {
- if (uin->msgcount < MAX_MSGS) {
+ int write_pos = uin->msgcount; /* try to avoid race */
+ if ( write_pos < (MAX_MSGS - 1) ) { /* race here */
unsigned char pager0 = uin->pager;
+ uin->msgcount = write_pos + 1;
uin->pager = 2;
- uin->msgs[uin->msgcount].pid = currpid;
- strlcpy(uin->msgs[uin->msgcount].userid, cuser.userid,
- sizeof(uin->msgs[uin->msgcount].userid));
- strlcpy(uin->msgs[uin->msgcount++].last_call_in, msg,
- sizeof(uin->msgs[uin->msgcount].last_call_in));
+ uin->msgs[write_pos].pid = currpid;
+ strlcpy(uin->msgs[write_pos].userid, cuser.userid,
+ sizeof(uin->msgs[write_pos].userid));
+ strlcpy(uin->msgs[write_pos].last_call_in, msg,
+ sizeof(uin->msgs[write_pos].last_call_in));
uin->pager = pager0;
} else if (flag != 2)
outmsg("\033[1;33;41m糟糕! 對方不行了! (收到太多水球) \033[37m@_@\033[m");