search

scandum / tintin

TinTin++, aka tt++, is an extensible console MUD client.
https://tintin.mudhalla.net
GNU General Public License v3.0
201 stars 56 forks source link

Crash when receiving large GMCP buffers #184

Open lorienhu opened 1 year ago

lorienhu commented 1 year ago

Tintin is crashing due to memory protection/buffer overflow upon receiving GMCP data larger than BUFFER_SIZE, which seems to be defined in the Tintin source as 40000.

Neither the Telnet RFC or the GMCP specification defines any maximum size for a single GMCP message, so there should probably be some handling for this.

scandum commented 1 year ago

One thing to be mindful of is to only call %1 once in the event, and it's an option to increase BUFFER_SIZE in tintin.h and recompile.

This is on my list of things to fix, but dynamic string handling in C is a bit of a challenge.