Protect against overrun of input buffer

The routine ReadLine() now has an extra argument to indicate the
maximum length of the string. All characters that exceed the size
will overwrite each other in the last position before the terminiating
null character, so that the linefeed will be kept.

diff --git a/UCI2WB.c b/UCI2WB.c
index e81472d..1799897 100644 (file)
--- a/UCI2WB.c
+++ b/UCI2WB.c
@@ -238,10 +238,10 @@ Move4GUI(char *m)
 }\r
 \r
 int\r
-ReadLine (FILE *f, char *line)\r
+ReadLine (FILE *f, char *line, int len)\r
 {\r
     int x, i = 0;\r
-    while((x = fgetc(f)) != EOF && (line[i] = x) != '\n') i++; line[++i] = 0;\r
+    while((x = fgetc(f)) != EOF && (line[i] = x) != '\n') i+=(i<len); line[++i] = 0;\r
     return (x != EOF);\r
 }\r
 \r
@@ -254,8 +254,8 @@ HandleEngineOutput()
        int i=0; char *p, dummy;\r
 \r
        fflush(stdout); fflush(toE);\r
-       if(fromF && !ReadLine(fromF, line))  fromF = 0, printf("# end fake\n");\r
-       if(!fromF && !ReadLine(fromE, line)) printf("tellusererror UCI2WB: %s died on me\n", binary), exit(0);\r
+       if(fromF && !ReadLine(fromF, line, 1022))  fromF = 0, printf("# end fake\n");\r
+       if(!fromF && !ReadLine(fromE, line, 1022)) printf("tellusererror UCI2WB: %s died on me\n", binary), exit(0);\r
        DPRINT("# engine said: %s", line), fflush(stdout);\r
        if(sscanf(line, "%s", command) != 1) continue;\r
        if(!strcmp(command, "bestmove")) {\r
@@ -460,7 +460,7 @@ GUI2Engine()
 \r
        for(difficult=0; !difficult; ) { // read and handle commands that can (or must) be handled during thinking\r
        fflush(toE); fflush(stdout);\r
-       if(!ReadLine(stdin, line)) printf("# EOF\n"), sprintf(line, "quit -1\n");\r
+       if(!ReadLine(stdin, line, 254)) printf("# EOF\n"), sprintf(line, "quit -1\n");\r
        if(!sscanf(line, "%s", command)) return;\r
        if(!strcmp(command, "usermove")) { difficult--; break; } // for efficiency during game play, moves, time & otim are tried first\r
        else if(!strcmp(command, "time"))   sscanf(line+4, "%d", &myTime),  myTime  = (10*myTime)/unit;\r