Imported Upstream version 0.52

diff --git a/README b/README
index 9420e208f9b917ddbcf1cbdd2c257ea1b2244441..0a5f5228cbfc870bacb62979f3355dd8cede21ad 100644 (file)
--- a/README
+++ b/README
@@ -51,6 +51,12 @@ how it goes, and send me diffs if needed!
 See the FAQ in this directory if you have any problems.
 
 
+FIXED IN VERSION 0.52
+=====================
+Fixed a buffer overflow vulnerability discovered by
+Artur Byszko / bajkero <bajkero@security.hack.pl>
+
+
 NEW IN VERSION 0.5
 ==================
 Netris now specifically looks for ncurses and uses color if it's
@@ -88,7 +94,7 @@ the game.
 Unlike standard T*tris, Netris gives you a little extra time after
 dropping a piece before it solidifies.  This allows you to slide the
 piece into a notch without waiting for it to fall the whole way down.
-In fact, if you can even slide it off a cliff and it'll start falling
+In fact, you can even slide it off a cliff and it'll start falling
 again.  If you think it should automatically drop again in this case,
 use the -D option.
 

diff --git a/VERSION b/VERSION
index 2eb3c4fe4eebcdea3da0790cc0ba74cb286ec4f4..3ccbc517cdf406c546dd6beb995ff58e78c095d9 100644 (file)
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-0.5
+0.52

diff --git a/inet.c b/inet.c
index dbfe7484f0d8b9bb2a65f956ce9afc7e9d979bb5..a8d9a9d9149c9b67e3c05516d1b040f970cad8f1 100644 (file)
--- a/inet.c
+++ b/inet.c
@@ -151,6 +151,9 @@ static MyEventType NetGenFunc(EventGenRec *gen, MyEvent *event)
        memcpy(data, netBuf, sizeof(data));
        type = ntoh2(data[0]);
        size = ntoh2(data[1]);
+       if (size >= sizeof(netBuf))
+               fatal("Received an invalid packet (too large), possibly an attempt\n"
+                         "  to exploit a vulnerability in versions before 0.52 !");
        netBufGoal = size;
        if (netBufSize < netBufGoal)
                return E_none;

diff --git a/robot_desc b/robot_desc
index 53415b25d013e12b329a5117be893eb3a2c6e818..3c9bacac05b92566129f129edc556fb59594207c 100644 (file)
--- a/robot_desc
+++ b/robot_desc
@@ -84,7 +84,7 @@ view of the board is incorrect until the "TimeStamp".
 <row> is an integer from 0 to boardHeight-1.  0 is the bottom row.
 
 <col0> ... <coln> are integers separated by spaces, one for each column.
-"0" indicates an empty square.  Positive integers indicates blocks.
+"0" indicates an empty square.  Positive integers indicate blocks.
 Currently only "1" is used, but in the future there may be special kinds of
 blocks indicated by higher numbers.  Negative integers indicate part of
 the currently falling piece.  For each block, the absolute value of the
@@ -151,8 +151,8 @@ long to fit on the screen may be truncated.
 EXAMPLE
 =======
 Here's a portion of an example log generated by the sample robot.  The
-sample robot generates a log file in "log" if the "-l" is given to sr
-(eg "netris -r 'sr -l'").
+sample robot generates a log file in "log" if the "-l" option is given
+to sr (eg "netris -r 'sr -l'").
 
 In this log file, every line is preceeded by two characters.  Lines
 sent from Netris to the robot are preceeded by two spaces "  ", and