patch <inspircd-userlist-ptr-safety.diff (Thanks nenolod)

git-svn-id: http://svn.inspircd.org/repository/trunk/inspircd@3630 e03df62e-2008-0410-955e-edbf42e46eb7

2 files changed, 18 insertions, 14 deletions

diff --git a/src/helperfuncs.cpp b/src/helperfuncs.cpp
index cae073ff4..ab9c3f46a 100644
--- a/src/helperfuncs.cpp
+++ b/src/helperfuncs.cpp
@@ -1323,9 +1323,12 @@ void userlist(userrec *user,chanrec *c)
 	}
 
 	char list[MAXBUF];
-	size_t dlen = snprintf(list,MAXBUF,"353 %s = %s :", user->nick, c->name);
+	size_t dlen, curlen;
+
+	dlen = curlen = snprintf(list,MAXBUF,"353 %s = %s :", user->nick, c->name);
+
 	int numusers = 0;
-	char* ptr = list + dlen - 1;
+	char* ptr = list + dlen;
 
 	CUList *ulist= c->GetUsers();
 
@@ -1345,25 +1348,26 @@ void userlist(userrec *user,chanrec *c)
 			continue;
 		}
 
-		const char* n = cmode(i->second,c);
-		if (*n)
-			*ptr++ = *n;
-		for (char* t = i->second->nick; *t; t++)
-			*ptr++ = *t;
-		*ptr++ = ' ';
+		size_t ptrlen = snprintf(ptr, MAXBUF, "%s%s ", cmode(i->second, c), i->second->nick);
+
+		curlen += ptrlen;
+		ptr += ptrlen;
+
 		numusers++;
 
-		if ((ptr - list) > (480-NICKMAX))
+		if (curlen > (480-NICKMAX))
 		{
 			/* list overflowed into multiple numerics */
-			*--ptr = 0;
 			WriteServ_NoFormat(user->fd,list);
-			dlen = snprintf(list,MAXBUF,"353 %s = %s :", user->nick, c->name);
-			ptr = list + dlen - 1;
+
+			/* reset our lengths */
+			dlen = curlen = snprintf(list,MAXBUF,"353 %s = %s :", user->nick, c->name);
+			ptr = list + dlen;
+
+			ptrlen = 0;
 			numusers = 0;
 		}
 	}
-	*--ptr = 0;
 
 	/* if whats left in the list isnt empty, send it */
 	if (numusers)
diff --git a/src/svn-rev.sh b/src/svn-rev.sh
index 8b1f627c1..5f044e139 100755
--- a/src/svn-rev.sh
+++ b/src/svn-rev.sh
@@ -1 +1 @@
-echo 3625
+echo 3629