mirror of
https://github.com/irssi/irssi.git
synced 2026-08-12 05:07:33 +02:00
The client of the future
https://irssi.org
- C 90.6%
- XS 3.4%
- Perl 2.1%
- Meson 2%
- Prolog 1.5%
- Other 0.4%
27f857e37b
In enqueue_otr_fragment(), once a ?OTR: reassembly is open, each
continuation fragment is appended to opc->full_msg and the buffer is
grown only if there isn't enough room:
if (msg_len > (opc->msg_size - opc->msg_len)) { realloc(...); }
memcpy(opc->full_msg + opc->msg_len, msg, msg_len);
opc->msg_len += msg_len;
opc->full_msg[opc->msg_len] = '\0';
The comparison uses '>' instead of '>='. When a fragment's length is
exactly equal to the remaining space (opc->msg_size - opc->msg_len),
the condition is false, so no realloc happens; the memcpy itself still
fits, but the following NUL-terminator write at
opc->full_msg[opc->msg_len] lands exactly one byte past the end of the
allocation, corrupting the adjacent heap chunk.
This is remotely reachable the same way as the other reassembly bugs
in this file: any user who can send the victim a private message can
drive the running remaining-space counter to land on an exact match
(remaining space grows by a small, attacker-observable amount on every
realloc, and fragment lengths are fully attacker controlled), then send
one more fragment of that exact length to trigger the overflow.
Fix the comparison to '>=' so the buffer is grown whenever there isn't
room for both the fragment bytes and the terminator.
|
||
|---|---|---|
| .github/workflows | ||
| .obs | ||
| docs | ||
| fuzz-support | ||
| scripts | ||
| src | ||
| subprojects | ||
| tests | ||
| themes | ||
| utils | ||
| .clang-format | ||
| .gitattributes | ||
| .gitignore | ||
| .muon_fmt.ini | ||
| AUTHORS | ||
| COPYING | ||
| INSTALL | ||
| irssi-icon.png | ||
| irssi.conf | ||
| MANIFEST.in | ||
| meson.build | ||
| meson_options.txt | ||
| NEWS | ||
| README.md | ||
| TODO | ||
Irssi
Irssi is a modular text mode chat client. It comes with IRC support built in, and there are third party ICB, SILC, XMPP (Jabber), PSYC and Quassel protocol modules available.
Download information
Development source installation
git clone https://github.com/irssi/irssi
cd irssi
meson Build
ninja -C Build && sudo ninja -C Build install
Release source installation
- Download release
- Verify signature
tar xJf irssi-*.tar.xz
cd irssi-*
meson Build
ninja -C Build && sudo ninja -C Build install
Requirements
- glib-2.32 or greater
- openssl
- perl-5.8 or greater (for perl support)
- terminfo or ncurses (for text frontend)
See the INSTALL file for details
Documentation
- New users guide
- Questions and Answers
- Check the built-in
/HELP, it has all the details on command syntax
Themes
Scripts
Modules
Security information
Please report security issues to staff@irssi.org. Thanks!
Bugs / Suggestions / Contributing
Check the GitHub issues if it is already listed in there; if not, open an issue on GitHub or send a mail to staff@irssi.org.
Irssi is always looking for developers. Feel free to submit patches through GitHub pull requests.
You can also contact the Irssi developers in #irssi on irc.libera.chat.