- Wed May 16 12:48:13 PDT 2001

[libfaim.git] / utils / faimtest / faimtest.c

diff --git a/utils/faimtest/faimtest.c b/utils/faimtest/faimtest.c
index 06102424c434c4d340042d9e4103462b6352c5f0..3f9857bad3d7ea9840321fb3b3eeae0f65461217 100644 (file)
--- a/utils/faimtest/faimtest.c
+++ b/utils/faimtest/faimtest.c
@@ -39,6 +39,7 @@
  */
 
 #include "faimtest.h"
+#include <sys/stat.h>
 
 static char *dprintf_ctime(void)
 {
@@ -359,6 +360,7 @@ int main(int argc, char **argv)
       printf("    -c name       Screen name of owner\n");
       printf("    -o            Login at startup, then prompt\n");
       printf("    -O            Login, never give prompt\n");
+      printf("    -b path       Path to AIM 3.5.1670 binaries\n");
       exit(0);
     }
   }
@@ -797,11 +799,37 @@ int faimtest_handleredirect(struct aim_session_t *sess, struct command_rx_struct
   return 1;
 }
 
-static int getaimdata(unsigned char *buf, int buflen, unsigned long offset, const char *modname)
+/*
+ * This is a little more complicated than it looks.  The module
+ * name (proto, boscore, etc) may or may not be given.  If it is
+ * not given, then use aim.exe.  If it is given, put ".ocm" on the
+ * end of it.
+ *
+ * Now, if the offset or length requested would cause a read past
+ * the end of the file, then the request is considered invalid.  Invalid
+ * requests are processed specially.  The value hashed is the
+ * the request, put into little-endian (eight bytes: offset followed
+ * by length).  
+ *
+ * Additionally, if the request is valid, the length is mod 4096.  It is
+ * important that the length is checked for validity first before doing
+ * the mod.
+ *
+ * Note to Bosco's Brigade: if you'd like to break this, put the 
+ * module name on an invalid request.
+ *
+ */
+static int getaimdata(unsigned char **bufret, int *buflenret, unsigned long offset, unsigned long len, const char *modname)
 {
   FILE *f;
   static const char defaultmod[] = "aim.exe";
   char *filename = NULL;
+  struct stat st;
+  unsigned char *buf;
+  int invalid = 0;
+
+  if (!bufret || !buflenret)
+    return -1;
 
   if (modname) {
 
@@ -823,31 +851,101 @@ static int getaimdata(unsigned char *buf, int buflen, unsigned long offset, cons
 
   }
 
-  dvprintf("memrequest: loading %d bytes from 0x%08lx in \"%s\"...\n", buflen, offset, filename);
+  if (stat(filename, &st) == -1) {
+    if (!modname) {
+      dperror("memrequest: stat");
+      free(filename);
+      return -1;
+    }
+    invalid = 1;
+  }
 
-  if (!(f = fopen(filename, "r"))) {
-    dperror("memrequest: fopen");
-    free(filename);
-    return -1;
+  if (!invalid) {
+    if ((offset > st.st_size) || (len > st.st_size))
+      invalid = 1;
+    else if ((st.st_size - offset) < len)
+      len = st.st_size - offset;
+    else if ((st.st_size - len) < len)
+      len = st.st_size - len;
   }
 
-  free(filename);
+  if (!invalid && len)
+    len %= 4096;
 
-  if (fseek(f, offset, SEEK_SET) == -1) {
-    dperror("memrequest: fseek");
-    fclose(f);
-    return -1;
-  }
+  if (invalid) {
+    int i;
+
+    free(filename); /* not needed */
+
+    dvprintf("memrequest: recieved invalid request for 0x%08lx bytes at 0x%08lx (file %s)\n", len, offset, modname);
+
+    i = 8;
+    if (modname)
+      i += strlen(modname);
+
+    if (!(buf = malloc(i)))
+      return -1;
+
+    i = 0;
+
+    if (modname) {
+      memcpy(buf, modname, strlen(modname));
+      i += strlen(modname);
+    }
+
+    /* Damn endianness. This must be little (LSB first) endian. */
+    buf[i++] = offset & 0xff;
+    buf[i++] = (offset >> 8) & 0xff;
+    buf[i++] = (offset >> 16) & 0xff;
+    buf[i++] = (offset >> 24) & 0xff;
+    buf[i++] = len & 0xff;
+    buf[i++] = (len >> 8) & 0xff;
+    buf[i++] = (len >> 16) & 0xff;
+    buf[i++] = (len >> 24) & 0xff;
+
+    *bufret = buf;
+    *buflenret = i;
+
+  } else {
+
+    if (!(buf = malloc(len))) {
+      free(filename);
+      return -1;
+    }
+
+    dvprintf("memrequest: loading %ld bytes from 0x%08lx in \"%s\"...\n", len, offset, filename);
+
+    if (!(f = fopen(filename, "r"))) {
+      dperror("memrequest: fopen");
+      free(filename);
+      free(buf);
+      return -1;
+    }
+
+    free(filename);
+
+    if (fseek(f, offset, SEEK_SET) == -1) {
+      dperror("memrequest: fseek");
+      fclose(f);
+      free(buf);
+      return -1;
+    }
+
+    if (fread(buf, len, 1, f) != 1) {
+      dperror("memrequest: fread");
+      fclose(f);
+      free(buf);
+      return -1;
+    }
 
-  if (fread(buf, buflen, 1, f) != 1) {
-    dperror("memrequest: fread");
     fclose(f);
-    return -1;
-  }
 
-  fclose(f);
+    *bufret = buf;
+    *buflenret = len;
+
+  }
 
-  return buflen;
+  return 0; /* success! */
 }
 
 /*
@@ -861,8 +959,9 @@ static int faimtest_memrequest(struct aim_session_t *sess, struct command_rx_str
 {
   va_list ap;
   unsigned long offset, len;
-  unsigned char *buf;
   char *modname;
+  unsigned char *buf;
+  int buflen;
   
   va_start(ap, command);
   offset = va_arg(ap, unsigned long);
@@ -870,25 +969,20 @@ static int faimtest_memrequest(struct aim_session_t *sess, struct command_rx_str
   modname = va_arg(ap, char *);
   va_end(ap);
 
-  if (!(buf = malloc(len))) {
-    dperror("memrequest: malloc");
-    return 0;
-  }
+  if (aimbinarypath && (getaimdata(&buf, &buflen, offset, len, modname) == 0)) {
 
-  if (aimbinarypath && (getaimdata(buf, len, offset, modname) == len)) {
+    aim_sendmemblock(sess, command->conn, offset, buflen, buf, AIM_SENDMEMBLOCK_FLAG_ISREQUEST);
 
-    aim_sendmemblock(sess, command->conn, offset, len, buf);
+    free(buf);
 
   } else {
 
     dvprintf("memrequest: unable to use AIM binary (\"%s/%s\"), sending defaults...\n", aimbinarypath, modname);
 
-    aim_sendmemblock(sess, command->conn, offset, len, NULL);
+    aim_sendmemblock(sess, command->conn, offset, len, NULL, AIM_SENDMEMBLOCK_FLAG_ISREQUEST);
 
   }
 
-  free(buf);
-
   return 1;
 }