Make some string ops bounded and fix bug in editor toggle command (#54)

* Replace a few strcat/sprintf instances with bounded variants

Also cleaned up the whitespace in the parse_edit_action function as it was
not consistent.

Fix bug in editor format command introduced in earlier commit

* Fix bug in editor toggle command when an escaped @ is in the buffer

Previously, toggling between @ and \t would always try to convert
@ to \t, even if already toggled, iff an escaped @ was present in the
buffer (i.e. '@@').

src/act.informative.c

@@ -2554,7 +2554,7 @@ ACMD(do_areas)
 static void list_scanned_chars(struct char_data * list, struct char_data * ch, int
 distance, int door)
 {
-  char buf[MAX_STRING_LENGTH], buf2[MAX_STRING_LENGTH];
+  char buf[MAX_STRING_LENGTH], buf2[MAX_STRING_LENGTH - 1];
 
   const char *how_far[] = {
     "close by",
@@ -2589,16 +2589,16 @@ distance, int door)
     if (!CAN_SEE(ch, i))
       continue;
     if (!*buf)
-      sprintf(buf, "You see %s", GET_NAME(i));
+      snprintf(buf, sizeof(buf), "You see %s", GET_NAME(i));
     else
-      strcat(buf, GET_NAME(i));
+      strncat(buf, GET_NAME(i), sizeof(buf) - strlen(buf) - 1);
     if (--count > 1)
-      strcat(buf, ", ");
+      strncat(buf, ", ", sizeof(buf) - strlen(buf) - 1);
     else if (count == 1)
-      strcat(buf, " and ");
+      strncat(buf, " and ", sizeof(buf) - strlen(buf) - 1);
     else {
-      sprintf(buf2, " %s %s.\r\n", how_far[distance], dirs[door]);
+      snprintf(buf2, sizeof(buf2), " %s %s.\r\n", how_far[distance], dirs[door]);
-      strcat(buf, buf2);
+      strncat(buf, buf2, sizeof(buf) - strlen(buf) - 1);
     }
 
   }

src/dg_olc.c

@@ -470,14 +470,14 @@ static void script_syntax_highlighting(struct descriptor_data *d, char *string)
             for (cmd = 0; *complete_cmd_info[cmd].command != '\n'; cmd++) {
                 if (complete_cmd_info[cmd].command_pointer == do_action) {
                     char replace_social[MAX_INPUT_LENGTH];
-                    sprintf(replace_social, "\tc%s\tn", complete_cmd_info[cmd].command);
+                    snprintf(replace_social, MAX_INPUT_LENGTH, "\tc%s\tn", complete_cmd_info[cmd].command);
                     line = str_replace(line, complete_cmd_info[cmd].command, replace_social);
                 }
             }
         }
 
-        strcat(buffer, line);
+        strncat(buffer, line, sizeof(buffer) - strlen(buffer) - 1);
-        strcat(buffer, "\tn\r\n");
+        strncat(buffer, "\tn\r\n", sizeof(buffer) - strlen(buffer) - 1);
     }
     
     page_string(d, buffer, TRUE);

src/improved-edit.c

@@ -102,7 +102,7 @@ void parse_edit_action(int command, char *string, struct descriptor_data *d)
   unsigned int total_len;
   char *s, *t, temp;
   char buf[MAX_STRING_LENGTH];
-  char buf2[MAX_STRING_LENGTH];
+  char buf2[MAX_STRING_LENGTH - 1];
 
   switch (command) {
   case PARSE_HELP:
@@ -129,7 +129,16 @@ void parse_edit_action(int command, char *string, struct descriptor_data *d)
       write_to_output(d, "No string.\r\n");        
       break;
     }
-    if (strchr(*d->str, '@')) {
+    bool has_at = FALSE;
+    for (char* c = *d->str; *c; ++c) {
+      if (*c == '@') {
+        if (*(++c) != '@') {
+          has_at = TRUE;
+          break;
+        }
+      }
+    }
+    if (has_at) {
       parse_at(*d->str);
       write_to_output(d, "Toggling (at) into (tab) Characters...\r\n");  
     } else {
@@ -280,7 +289,7 @@ void parse_edit_action(int command, char *string, struct descriptor_data *d)
     }
     *buf = '\0';
     if (line_high < 999999 || line_low > 1)
-      sprintf(buf, "Current buffer range [%d - %d]:\r\n", line_low, line_high);
+      snprintf(buf, sizeof(buf), "Current buffer range [%d - %d]:\r\n", line_low, line_high);
     i = 1;
     total_len = 0;
     s = *d->str;
@@ -303,12 +312,12 @@ void parse_edit_action(int command, char *string, struct descriptor_data *d)
     if (s) {
       temp = *s;
       *s = '\0';
-      strcat(buf, t);
+      strncat(buf, t, sizeof(buf) - strlen(buf) - 1);
       *s = temp;
     } else
-      strcat(buf, t);
+      strncat(buf, t, sizeof(buf) - strlen(buf) - 1);
     /* This is kind of annoying...but some people like it. */
-    sprintf(buf + strlen(buf), "\r\n%d line%sshown.\r\n", total_len, (total_len != 1) ? "s " : " ");
+    snprintf(buf + strlen(buf), sizeof(buf) - strlen(buf), "\r\n%d line%sshown.\r\n", total_len, (total_len != 1) ? "s " : " ");
     page_string(d, buf, TRUE);
     break;
   case PARSE_LIST_NUM:
@@ -358,20 +367,20 @@ void parse_edit_action(int command, char *string, struct descriptor_data *d)
         s++;
         temp = *s;
         *s = '\0';
-	char buf3[8];
+        char buf3[9];
         sprintf(buf3, "%4d: ", (i - 1));
-	strcat(buf, buf3);
+        strncat(buf, buf3, sizeof(buf) - strlen(buf) - 1);
-	strcat(buf, t);
+        strncat(buf, t, sizeof(buf) - strlen(buf) - 1);
         *s = temp;
         t = s;
       }
     if (s && t) {
       temp = *s;
       *s = '\0';
-      strcat(buf, t);
+      strncat(buf, t, sizeof(buf) - strlen(buf) - 1);
       *s = temp;
     } else if (t)
-      strcat(buf, t);
+      strncat(buf, t, sizeof(buf) - strlen(buf) - 1);
 
     page_string(d, buf, TRUE);
     break;
@@ -383,7 +392,7 @@ void parse_edit_action(int command, char *string, struct descriptor_data *d)
       return;
     }
     line_low = atoi(buf);
-    strcat(buf2, "\r\n");
+    strncat(buf2, "\r\n", sizeof(buf2) - strlen(buf2) - 1);
 
     i = 1;
     *buf = '\0';
@@ -409,11 +418,11 @@ void parse_edit_action(int command, char *string, struct descriptor_data *d)
         return;
       }
       if (*d->str && **d->str)
-	strcat(buf, *d->str);
+        strncat(buf, *d->str, sizeof(buf) - strlen(buf) - 1);
       *s = temp;
-      strcat(buf, buf2);
+      strncat(buf, buf2, sizeof(buf) - strlen(buf) - 1);
       if (s && *s)
-	strcat(buf, s);
+        strncat(buf, s, sizeof(buf) - strlen(buf) - 1);
       RECREATE(*d->str, char, strlen(buf) + 3);
 
       strcpy(*d->str, buf);
@@ -431,7 +440,7 @@ void parse_edit_action(int command, char *string, struct descriptor_data *d)
       return;
     }
     line_low = atoi(buf);
-    strcat(buf2, "\r\n");
+    strncat(buf2, "\r\n", sizeof(buf2) - strlen(buf2) - 1);
 
     i = 1;
     *buf = '\0';
@@ -458,18 +467,18 @@ void parse_edit_action(int command, char *string, struct descriptor_data *d)
         temp = *s;
         *s = '\0';
         /* Put the first 'good' half of the text into storage. */
-	strcat(buf, *d->str);
+        strncat(buf, *d->str, sizeof(buf) - strlen(buf) - 1);
         *s = temp;
       }
       /* Put the new 'good' line into place. */
-      strcat(buf, buf2);
+      strncat(buf, buf2, sizeof(buf) - strlen(buf) - 1);
       if ((s = strchr(s, '\n')) != NULL) {
         /* This means that we are at the END of the line, we want out of there,
          * but we want s to point to the beginning of the line. AFTER the line 
          * we want edited. */
         s++;
         /* Now put the last 'good' half of buffer into storage. */
-	strcat(buf, s);
+        strncat(buf, s, sizeof(buf) - strlen(buf) - 1);
       }
       /* Check for buffer overflow. */
       if (strlen(buf) > d->max_str) {
@@ -511,7 +520,7 @@ int format_text(char **ptr_string, int mode, struct descriptor_data *d, unsigned
   if ((flow = *ptr_string) == NULL)
     return 0;
 
-  strcpy(str, flow);
+  strncpy(str, flow, sizeof(str) - 1);
 
   for (i = 0; i < low - 1; i++) {
     start = strtok(str, "\n");
@@ -519,13 +528,13 @@ int format_text(char **ptr_string, int mode, struct descriptor_data *d, unsigned
       write_to_output(d, "There aren't that many lines!\r\n");
       return 0;
     }
-    strcat(formatted, strcat(start, "\n"));
+    strncat(formatted, strcat(start, "\n"), sizeof(formatted) - strlen(formatted) - 1);
     flow = strstr(flow, "\n");
-    strcpy(str, ++flow);
+    strncpy(str, ++flow, sizeof(str) - 1);
   }
 
   if (IS_SET(mode, FORMAT_INDENT)) {
-    strcat(formatted, "   ");
+    strncat(formatted, "   ", sizeof(formatted) - strlen(formatted) - 1);
     line_chars = 3;
   } else {
     line_chars = 0;
@@ -591,14 +600,14 @@ int format_text(char **ptr_string, int mode, struct descriptor_data *d, unsigned
       }
 
       if (line_chars + strlen(start) + 1 - color_chars > PAGE_WIDTH) {
-        strcat(formatted, "\r\n");
+        strncat(formatted, "\r\n", sizeof(formatted) - strlen(formatted) - 1);
         line_chars = 0;
         color_chars = count_color_chars(start);
       }
 
       if (!cap_next) {
         if (line_chars > 0) {
-          strcat(formatted, " ");
+          strncat(formatted, " ", sizeof(formatted) - strlen(formatted) - 1);
           line_chars++;
         }
       } else {
@@ -607,38 +616,38 @@ int format_text(char **ptr_string, int mode, struct descriptor_data *d, unsigned
       }
 
       line_chars += strlen(start);
-      strcat(formatted, start);
+      strncat(formatted, start, sizeof(formatted) - strlen(formatted) - 1);
 
       *flow = temp;
     }
 
     if (cap_next_next && *flow) {
       if (line_chars + 3 - color_chars > PAGE_WIDTH) {
-        strcat(formatted, "\r\n");
+        strncat(formatted, "\r\n", sizeof(formatted) - strlen(formatted) - 1);
         line_chars = 0;
         color_chars = count_color_chars(start);
       } else if (*flow == '\"' || *flow == '\'') {
-        char buf[MAX_STRING_LENGTH];
+        char buf[MAX_STRING_LENGTH - 1];
-        sprintf(buf, "%c  ", *flow);
+        snprintf(buf, sizeof(buf), "%c  ", *flow);
-        strcat(formatted, buf);
+        strncat(formatted, buf, sizeof(formatted) - strlen(formatted) - 1);
         flow++;
         line_chars++;
       } else {
-        strcat(formatted, "  ");
+        strncat(formatted, "  ", sizeof(formatted) - strlen(formatted) - 1);
         line_chars += 2;
       }
     }
   }
   if (*flow)
-    strcat(formatted, "\r\n");
+    strncat(formatted, "\r\n", sizeof(formatted) - strlen(formatted) - 1);
-  strcat(formatted, flow);
+  strncat(formatted, flow, sizeof(formatted) - strlen(formatted) - 1);
   if (!*flow)
-    strcat(formatted, "\r\n");
+    strncat(formatted, "\r\n", sizeof(formatted) - strlen(formatted) - 1);
 
-  if (strlen(formatted) + 1 > maxlen)
+  int len = MIN(maxlen, strlen(formatted) + 1);
-    formatted[maxlen - 1] = '\0';
+  RECREATE(*ptr_string, char, len);
-  RECREATE(*ptr_string, char, MIN(maxlen, strlen(formatted) + 1));
+  strncpy(*ptr_string, formatted, len - 1);
-  strcpy(*ptr_string, formatted);
+  (*ptr_string)[len - 1] = '\0';
   return 1;
 }
 
@@ -666,21 +675,22 @@ int replace_str(char **string, char *pattern, char *replacement, int rep_all, un
         i = -1;
         break;
       }
-      strcat(replace_buffer, jetsam);
+      strncat(replace_buffer, jetsam, max_size - strlen(replace_buffer) -1);
-      strcat(replace_buffer, replacement);
+      strncat(replace_buffer, replacement, max_size - strlen(replace_buffer) - 1);
       *flow = temp;
       flow += strlen(pattern);
       jetsam = flow;
     }
-    strcat(replace_buffer, jetsam);
+    strncat(replace_buffer, jetsam, max_size - strlen(replace_buffer) - 1);
   } else {
     if ((flow = (char *)strstr(*string, pattern)) != NULL) {
       i++;
       flow += strlen(pattern);
       len = ((char *)flow - (char *)*string) - strlen(pattern);
-      strncpy(replace_buffer, *string, len);
+      strncpy(replace_buffer, *string, len < max_size - 1 ? len : max_size - 1);
-      strcat(replace_buffer, replacement);
+      replace_buffer[max_size - 1] = '\0';
-      strcat(replace_buffer, flow);
+      strncat(replace_buffer, replacement, max_size - strlen(replace_buffer) - 1);
+      strncat(replace_buffer, flow, max_size - strlen(replace_buffer) - 1);
     }
   }