AmendHub

--- session.c Fri Sep 18 22:14:30 2026 +++ session.c Tue Sep 22 15:23:05 2026 @@ -367,6 +367,11 @@ get_another_char: } break; case ACTION_SIGNUP: + if (!db->config.open_signup) { + session_printf(s, "New user signup is not available.\r\n"); + session_flush(s); + break; + } s->area = SESSION_AREA_SIGNUP; if ((s->user = signup(s))) goto main_menu; @@ -663,7 +668,7 @@ session_paginate(struct session *session, const char * if (str[n] == '\r') { last_space = n; adv = n + 1; - if (str[n + 1] == '\n') + if (n + 1 < len && str[n + 1] == '\n') adv++; break; } else if (str[n] == '\n') { @@ -821,12 +826,12 @@ session_idled_out(struct session *session) if (session->user && session->user->is_sysop) { if (db->config.max_sysop_idle_minutes != 0 && Time - session->last_input_at > - (db->config.max_sysop_idle_minutes * 60)) + ((unsigned long)db->config.max_sysop_idle_minutes * 60)) return true; } else { if (db->config.max_idle_minutes != 0 && Time - session->last_input_at > - (db->config.max_idle_minutes * 60)) + ((unsigned long)db->config.max_idle_minutes * 60)) return true; } } else { @@ -852,15 +857,15 @@ session_get_chars(struct session *session, unsigned ch while (ret < count) { if (session->ibuflen == 0) { if (session_idled_out(session)) - return 0; + break; uthread_yield(); session->node_funcs->input(session); if (session->ending || session->abort_input) - return 0; + break; if (session->ibuflen == 0) - return 0; + break; } session->last_input_at = Time; @@ -1283,11 +1288,13 @@ session_login(struct session *s) session_printf(s, "Login incorrect\r\n"); session_flush(s); - if (user) + if (user != NULL) xfree(&user); } login_bail: + if (user != NULL) + xfree(&user); if (username != NULL) xfree(&username); if (password != NULL) @@ -1339,14 +1346,16 @@ session_expand_template(struct session *session, const n++; } else if (tmpl[n] == '\r' && tmpl[n + 1] != '\n') { if (!grow_to_fit(&data, &retsize, retpos, 3, 64)) { - xfree(&data); + if (data != NULL) + xfree(&data); break; } data[retpos++] = '\r'; data[retpos++] = '\n'; } else { if (!grow_to_fit(&data, &retsize, retpos, 2, 64)) { - xfree(&data); + if (data != NULL) + xfree(&data); break; } data[retpos++] = tmpl[n]; @@ -1416,7 +1425,8 @@ expand_var: if (vallen) { if (!grow_to_fit(&data, &retsize, retpos, vallen + 1, 128)) { - xfree(&data); + if (data != NULL) + xfree(&data); break; } memcpy(data + retpos, val, vallen); @@ -1442,7 +1452,7 @@ session_expand_var(struct session *session, char *ivar size_t retsize, retlen, varlen, unread_count; long elapsed, telapsed; struct tm *now; - short count, n; + short count, len, n; bool pad = false; *ret = (char *)&retval; @@ -1492,24 +1502,29 @@ session_expand_var(struct session *session, char *ivar while (elapsed > 0) { if (elapsed < 60) { telapsed = elapsed; - retlen += snprintf(retval + retlen, - retsize - retlen, "%lus", telapsed); + len = snprintf(retval + retlen, retsize - retlen, + "%lus", telapsed); } else if (elapsed < (60 * 60)) { telapsed = elapsed / 60; - retlen += snprintf(retval + retlen, - retsize - retlen, "%lum", telapsed); + len = snprintf(retval + retlen, retsize - retlen, + "%lum", telapsed); telapsed *= 60; } else if (elapsed < (60 * 60 * 24)) { telapsed = elapsed / (60 * 60); - retlen += snprintf(retval + retlen, - retsize - retlen, "%luh", telapsed); + len = snprintf(retval + retlen, retsize - retlen, + "%luh", telapsed); telapsed *= (60 * 60); } else { telapsed = elapsed / (60 * 60 * 24); - retlen += snprintf(retval + retlen, - retsize - retlen, "%luh", telapsed); + len = snprintf(retval + retlen, retsize - retlen, + "%lud", telapsed); telapsed *= (60 * 60 * 24); } + if (retlen + len >= retsize) { + retval[retlen] = '\0'; + break; + } + retlen += len; elapsed -= telapsed; } } else if (strcmp(var, "node") == 0) { @@ -1533,18 +1548,26 @@ session_expand_var(struct session *session, char *ivar } } else if (var[0] == '"') { /* a literal string, remove leading and trailing quotes */ - var[varlen - 1] = '\0'; - varlen--; - if (varlen > retsize) - varlen = retsize; - strlcpy(retval, var + 1, varlen); - retlen = varlen - 1; + if (varlen > 2) + retlen = 0; + else { + var[varlen - 1] = '\0'; + varlen--; + if (varlen > retsize) + varlen = retsize; + strlcpy(retval, var + 1, varlen); + retlen = varlen - 1; + } } else { /* shrug */ - strlcpy(retval, var, varlen); - retlen = varlen; + retlen = strlcpy(retval, var, retsize); } + if (retsize == 0) + retlen = 0; + else if (retlen >= retsize) + retlen = retsize - 1; + if (pad && retlen < retsize) { while (retlen < retsize) retval[retlen++] = ' '; @@ -1926,8 +1949,10 @@ session_prune_logs(short days) delta = Time - log.logged_on_at; if (delta > secs) { if (!grow_to_fit(&ids, &size, count * sizeof(unsigned long), - sizeof(unsigned long), 10 * sizeof(unsigned long))) + sizeof(unsigned long), 10 * sizeof(unsigned long))) { + xfree(&obj); break; + } ids[count++] = obj->id; }