#DEFINE STR_LEN (256) // There is vulnerable code somewhere in here // I'm trying to find it. // Every little bit helps :) typedef struct { byte data[BUF_SIZE]; int len; int read_index; } buffer_t; PRIVATE buffer_t b_in; typedef buffer_t *buffer_ptr; int unpack_string(buffer_ptr b, char *s) { int i; int len; byte *bp; /* My suggestion. */ if (strlen(b->data) != b->len) { /* Invalid length assigned. b->len = strlen(b->data); and continue? or return(-1); ? */ } /* Suggestion end. */ if ((b->read_index + INT32_SIZE) > b->len) { fprintf(stderr, "unpack_string(): %s\n", BUFF_ERR2); return (-1); } len = unpack_int(b); if ((b->read_index + len) > b->len) { fprintf(stderr, "unpack_string(): %s\n", BUFF_ERR2); return (-1); } bp = (byte *) s; for (i = 0; i < (len-1); i++) { *(bp++) = b->data[b->read_index++]; } *(bp) = 0; b->read_index++; return (0); } PUBLIC void msg_unpack_string(char *s) { if (unpack_string(&b_in, s) == -1) { fprintf(stderr, MSG_LIB_ERR2); } }