Re: Eggrop bug

From: Jeff Fisher (guppy_at_techmonkeys.org)
Date: 02/10/04

  • Next message: Darren Reed: "Re: Round One: "DLL Proxy" Attack Easily Hijacks SSL from Internet Explorer" 
    Date: Mon, 09 Feb 2004 22:20:23 -0600
To: "cyborgirl@libero.it" <cyborgirl@libero.it>

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

    | Issue Details:
    | ==============
    | share.mod use tandem buffers to handle userfile resync transfers.
    tandem buffers
    | are checked
    | minutely by check_expired_tbufs() in order to flush tandem buffers
    older than 15
    | minutes
    | (resync_time). check_expired_tbufs() accomplish also to handle
    userfile requests
    | in limbo
    | (that haven't received yet any response from tandem bot). While doing
    those
    | checks the
    | programmer has left out some parentheses and the worst has happened:
    | Here the incriminated snip:

    Thankfully resync sharing is considered broken and most people do not
    use it. Indeed though, this is a bug and thank you for finding it.

    | --- eggdrop1.6.15/src/mod/share.mod/share.c Sat Feb 7 05:13:32 2004
    | +++ eggdrop1.6.15-sp/src/mod/share.mod/share.c Sat Feb 7 05:43:33 2004
    | @@ -1457,9 +1457,11 @@
    | /* ^ send it again in case they missed it */
    | /* If it's a share bot that hasnt been sharing, ask again */
    | } else if (!(dcc[i].status & STAT_SHARE)) {
    | - if (dcc[i].user && (bot_flags(dcc[i].user) & BOT_AGGRESSIVE))
    | + /* Patched from original source by giusc@gbss.it <20040207> */
    | + if (dcc[i].user && (bot_flags(dcc[i].user) & BOT_AGGRESSIVE)) {
    | dprintf(i, "s u?\n");
    | - dcc[i].status |= STAT_OFFERED;
    | + dcc[i].status |= STAT_OFFERED;
    | + }
    | }
    | }
    | }
    |

    This patch has been applied to the latest CVS copy with the correct credits.

    | Vendor status:
    | ===============
    | Notified on 07 February 2004
    |

    Where did you notify eggheads? I seem to be blind while looking for it.

    Jeff

    - --
    Jeff Fisher <guppy@eggheads.org>
    Eggdrop Development Team
    Eggheads.org
    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.2.1 (GNU/Linux)
    Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

    iD8DBQFAKFwHGi4Ni4h3f1YRAkoGAJ9FUHyPMhXW2z9/EU/+3gm9ac4O8gCgh0Ld
    pghogz/K0O2at7ODk8JVOnM=
    =yyRM
    -----END PGP SIGNATURE-----

  • Next message: Darren Reed: "Re: Round One: "DLL Proxy" Attack Easily Hijacks SSL from Internet Explorer"
    Loading