From 8b1485ad2959d64ab841656ca235059f52c13e45 Mon Sep 17 00:00:00 2001
From: kcwu <kcwu@63ad8ddf-47c3-0310-b6dd-a9e9d9715204>
Date: Tue, 19 Oct 2004 13:37:10 +0000
Subject: fix utmpfix that corrupt SHM make utmpfix more sensitive on bad
 userid and friend number

git-svn-id: http://opensvn.csie.org/pttbbs/trunk/pttbbs@2266 63ad8ddf-47c3-0310-b6dd-a9e9d9715204
---
 util/shmctl.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/util/shmctl.c b/util/shmctl.c
index f3067fc2..b6819c8b 100644
--- a/util/shmctl.c
+++ b/util/shmctl.c
@@ -1,6 +1,7 @@
 /* $Id$ */
 #include "bbs.h"
 #include <sys/wait.h>
+#include <string.h>
 
 extern SHM_t   *SHM;
 
@@ -21,7 +22,9 @@ int logout_friend_online(userinfo_t *utmp)
 	    utmp->friend_online[i]=0;
 	    ui = &SHM->uinfo[j]; 
 	    if(ui->pid && ui!=utmp){
-		for(k=0; k<ui->friendtotal && 
+		if(ui->friendtotal > MAX_FRIEND)
+		    printf("\tfriend(%d) has too many(%d) friends\n", j, ui->friendtotal);
+		for(k=0; k<ui->friendtotal && k<MAX_FRIEND &&
 			(int)(ui->friend_online[k] & 0xFFFFFF) !=offset; k++);
 		if( k < ui->friendtotal && k < MAX_FRIEND ){
 		    ui->friendtotal--;
@@ -133,6 +136,10 @@ int utmpfix(int argc, char **argv)
 	clean = NULL;
 	if( !isalpha(SHM->uinfo[which].userid[0]) )
 	    clean = "userid error";
+	else if( memchr(SHM->uinfo[which].userid, '\0', IDLEN+1)==NULL)
+	    clean = "userid without z";
+	else if( SHM->uinfo[which].friendtotal > MAX_FRIEND)
+	    clean = "too many friend";
 	else if( kill(SHM->uinfo[which].pid, 0) < 0 ){
 	    clean = "process error";
 	    purge_utmp(&SHM->uinfo[which]);
-- 
cgit v1.2.3