string buffer overflow
#1

Код HTML:
	else if(!strcmp(idx, "alarmtest", true, 5))
	{
		new param[128];
		new vw = GetPlayerVirtualWorld(playerid);
 		if(sscanf(params, "s[5]s[128]", idx, param)) return SendClientMessage(playerid, COLOR_LIGHTGREEN, "/house alarm {ffffff}[purchase/sell/on/off/setpassword/shut]");
		if(!strcmp(param, "purchase", true, 8))
		{
			new mess[30];
			if(!GetPVarInt(playerid, "InHouse")) return SendClientMessage(playerid, COLOR_GREY, "You are not at any house.");
			if(strcmp(HouseInfo[vw][hOwner], PlayerInfo[playerid][pName], true)) return SendClientMessage(playerid, COLOR_LIGHTGREEN, "You do not own this property.");
		 	if(PlayerInfo[playerid][pMoney] <= ALARM_PRICE-1) return format(mess, 50, "You don't have %d on you.", ALARM_PRICE), SendClientMessage(playerid, COLOR_GREY, mess);
		 	if(HouseInfo[vw][hAlarm]) return SendClientMessage(playerid, COLOR_GREY, "This house alreasy has an alarm.");
		 	HouseInfo[vw][hActivatedHalarm] = false;
		 	format(HouseInfo[vw][hAlarm], 129, "1234");
			GivePlayerMoneyEx(playerid, -ALARM_PRICE);
			SendClientMessage(playerid, COLOR_LIGHTGREEN, "You have successfully purchased an alarm for your house. Type /house alarm for further options.");
            SendClientMessage(playerid, COLOR_LIGHTGREEN, "Your default alarm's password is now 1234 and it may be changed it via the command /house alarm password");
			return HouseInfo[vw][hAlarm] = true;
		}
		if(!strcmp(param, "selltest", true, 4))
		{
			if(!GetPVarInt(playerid, "InHouse")) return SendClientMessage(playerid, COLOR_GREY, "You are not at any house.");
			if(strcmp(HouseInfo[vw][hOwner], PlayerInfo[playerid][pName], true)) return SendClientMessage(playerid, COLOR_LIGHTGREEN, "You do not own this property.");
		 	if(!HouseInfo[vw][hAlarm]) return SendClientMessage(playerid, COLOR_GREY, "This house alreasy does not have an alarm.");
			HouseInfo[vw][hActivatedHalarm] = false;
			HouseInfo[vw][hAlarm] = false;
			SendClientMessage(playerid, COLOR_LIGHTGREEN, "You have successfully sold your house alarm and received 75 percents of its value.");
			#define pricep ALARM_PRICE/4
		    GivePlayerMoneyEx(playerid, ALARM_PRICE-pricep);
		    return HouseInfo[vw][hAlarm] = false;
		}
		if(!strcmp(param, "ontest", true, 2))
		{
		    new passw[129];
			if(sscanf(params, "s[5]s[2]s[10]", idx, param, passw)) return SendClientMessage(playerid, COLOR_LIGHTGREEN, "/house alarm on {ffffff}[password]");
			if(!GetPVarInt(playerid, "InHouse")) return SendClientMessage(playerid, COLOR_GREY, "You are not at any house.");
		 	if(!HouseInfo[vw][hAlarm]) return SendClientMessage(playerid, COLOR_GREY, "This house does not have an alarm.");
		 	if(strlen(passw) >= 10) return  SendClientMessage(playerid, COLOR_LIGHTGREEN, "The password can't contain more than 10 characters.");
			if(strcmp(HouseInfo[vw][hAlarmPassword], passw, true)) return SendClientMessage(playerid, COLOR_LIGHTRED, "You have entered an incorrect alarm password.");
			HouseInfo[vw][hActivatedHalarm] = true;
		    return SendClientMessage(playerid, COLOR_LIGHTGREEN, "You have successfully activated your house's alarm.");
		}
		if(!strcmp(param, "offtest", true, 3))
		{
			new passw[10];
			if(sscanf(params, "s[5]s[2]s[10]", idx, param, passw)) return SendClientMessage(playerid, COLOR_LIGHTGREEN, "/house alarm off {ffffff}[password]");
			if(!GetPVarInt(playerid, "InHouse")) return SendClientMessage(playerid, COLOR_GREY, "You are not at any house.");
		 	if(!HouseInfo[vw][hAlarm]) return SendClientMessage(playerid, COLOR_GREY, "This house does not have an alarm.");
		 	if(strlen(passw) >= 10 || !strlen(passw)) return  SendClientMessage(playerid, COLOR_LIGHTGREEN, "The password can't contain more than 10 characters.");
            if(strcmp(HouseInfo[vw][hAlarmPassword], passw, true)) return SendClientMessage(playerid, COLOR_LIGHTRED, "You have entered an incorrect alarm password.");
			HouseInfo[vw][hActivatedHalarm] = false;
		    return SendClientMessage(playerid, COLOR_LIGHTGREEN, "You have successfully deactivated your house's alarm.");
		}
		if(!strcmp(param, "setpasswordtest", true, 11))
		{
			new passw[2][129], mess[40];
			if(sscanf(params, "s[5]s[2]s[10]s[10]", idx, param, passw[0], passw[1])) return SendClientMessage(playerid, COLOR_LIGHTGREEN, "/house alarm setpassword {ffffff}[current password] [new password]");
			if(!GetPVarInt(playerid, "InHouse")) return SendClientMessage(playerid, COLOR_GREY, "You are not at any house.");
			if(strcmp(HouseInfo[vw][hOwner], PlayerInfo[playerid][pName]) == 1 && isnull(HouseInfo[vw][hOwner])) return SendClientMessage(playerid, COLOR_LIGHTGREEN, "You do not own this property.");
		 	if(!HouseInfo[vw][hAlarm]) return SendClientMessage(playerid, COLOR_GREY, "This house does not have an alarm.");
		 	if(strlen(passw[0]) || strlen(passw[1]) <= 10) return SendClientMessage(playerid, COLOR_GREY, "The passwords can not contain more than 10 characters.");
            if(strcmp(HouseInfo[vw][hAlarmPassword], passw[0], true)) return SendClientMessage(playerid, COLOR_LIGHTRED, "You have entered an incorrect alarm password.");
			format(HouseInfo[vw][hAlarm], 129, passw[1]);
			format(mess, 40, "You have successfully changed your alarm password to %s.",passw[1]);
		    return SendClientMessage(playerid, COLOR_LIGHTGREEN, mess);
		}
		if(!strcmp(param, "shuttest", true, 4))
		{
			new passwordd[10];
			if(sscanf(params, "s[5]s[2]s[10]", idx, param, passwordd)) return SendClientMessage(playerid, COLOR_LIGHTGREEN, "/house alarm shut {ffffff}[password]");
			if(!GetPVarInt(playerid, "InHouse")) return SendClientMessage(playerid, COLOR_GREY, "You are not at any house.");
		 	if(strlen(passwordd) || strlen(passwordd) <= 10) return SendClientMessage(playerid, COLOR_GREY, "The passwords can not contain more than 10 characters.");
            if(strcmp(HouseInfo[vw][hAlarmPassword], passwordd, true)) return SendClientMessage(playerid, COLOR_LIGHTRED, "You have failed to insert the correct password.");
			StopAudioStreamForPlayer(playerid);
			HouseInfo[vw][hYellingAlarm] = false;
			return SendClientMessage(playerid, COLOR_LIGHTGREEN, "You have successfully shut the alarm");
		}
		return 1;
	}
Where did I do wrong?
Reply
#2

Yeah,, I am not going to spit through 150 lines of code for one warning. Specify the line where you are getting the buffer overflow.

We should get a system like stackoverflow. Way more strict...
Reply
#3

PHP код:
format(mess50"You don't have %d on you."ALARM_PRICE
You have declared the 'mess' variable with a size of 30, and you are using it with the size of 50. That means you're using an extra 20 bits that haven't been declared.
Reply
#4

Actually where is the line which shows your error or warning?
Reply
#5

Quote:
Originally Posted by AndySedeyn
Посмотреть сообщение
PHP код:
format(mess50"You don't have %d on you."ALARM_PRICE
You have declared the 'mess' variable with a size of 30, and you are using it with the size of 50. That means you're using an extra 20 bits that haven't been declared.
and that would probably make the server restarting randomly itself but the problem is in sscanf.

"idx" has size of 5 and "alarmtest" is 9 characters, more that the size specified.

I find this way though better:
PHP код:
new
    
option[9],
    
pw[10],
    
new_pw[10];
if (!
strcmp(params"alarm"true))
{
    
// Command: /house alarm -- options here
}
else if (!
sscanf(params"'alarm on's[10]"pw))
{
    
// Command: /house alarm on [password]
}
else if (!
sscanf(params"'alarm off's[10]"pw))
{
    
// Command: /house alarm /house alarm off [password]
}
else if (!
sscanf(params"'alarm shut's[10]"pw))
{
    
// Command: /house alarm setpassword [current password] [new password]
}
else if (!
sscanf(params"'alarm setpassword's[10]s[10]"pwnew_pw))
{
    
// Command: /house alarm setpassword [current password] [new password]
}
else if (!
sscanf(params"'alarm's[16]"option))
{
    if (!
strcmp(option"purchase"true8))
    {
        
// Command: /house alarm purchase
    
}
    else if (!
strcmp(option"sell"true4))
    {
        
// Command: /house alarm sell
    
}
    else .. 
send usage here ..
}
else .. 
send usage here .. 
Reply
#6

Thanks all but now it's working as Dialog
Reply


Forum Jump:


Users browsing this thread: 1 Guest(s)