Say Links

**KLS** · #33 05-22-2009, 03:53 PM

Code:

			char* response;
			int sayid = ivrs->item_id - 500000;

			if (sayid && sayid > 0) 
			{
				const char *ERR_MYSQLERROR = "Error in saylink phrase queries after clicking the link";
				char errbuf[MYSQL_ERRMSG_SIZE];
				char *query = 0;
				MYSQL_RES *result;
				MYSQL_ROW row;
				

				if(database.RunQuery(query,MakeAnyLenString(&query,"SELECT `phrase` FROM saylink WHERE `id` = '%i'", sayid),errbuf,&result))
				{
					if (mysql_num_rows(result) == 1)
					{
						row = mysql_fetch_row(result);
						strcpy(response, row[0]);
					}

This is at best a crash and at worse something far more dangerous. You can't simply strcpy to memory that does not exist. While there's a chance because you don't initialize response that the memory does exist you're going to be overwriting random data and it's going to do *bad* things to your server.

Code:

char response[64];

Also it better not be crashing the zone just because of something as trivial as not having a target, there should be sanity checks in place to counter that.