https://gitlab.synchro.net/main/sbbs/-/commit/75008b3055306224ca0272cc
Modified Files:
src/syncterm/ripper.c
Log Message:
Fix a couple use-after-free bugs in RIP

This likely is the cause of bug 140.

The first one, the LCF flag is copied out of the cterm struct
after cterm_end() is called (which frees the struct). Copy moved
to before cterm_end().

The second one is trickier... it's executing the commands in a mouse
button, and one of the commands is to delete all the mouse button
commands. This ends up free()ing the string that's currently being
parsed while it's being parsed. We now use a strdup() of the string
which we free at the end of the function.
--- SBBSecho 3.20-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

https://gitlab.synchro.net/main/sbbs/-/commit/9fefe60690d8c378c13ccd96
Modified Files:
src/syncterm/ripper.c
Log Message:
Fix builds that don't support any graphics.
--- SBBSecho 3.20-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

https://gitlab.synchro.net/main/sbbs/-/commit/1a74630f9654033b92b0fe28
Modified Files:
src/syncterm/ripper.c
Log Message:
When RIP changes the vstat mode, also change the cursor

When changing between 8 and 16 row fonts in RIP mode, the cursor
start and end was left for the old font size... 16 -> 8 would leave
the cursor one line below the current position, and 8 -> 16 would
leave the cursor in the middle of the cell.

This hacks the vstat deeper to fix up the cursor as well.

Reported by skipperdoodle1947.
--- SBBSecho 3.20-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

https://gitlab.synchro.net/main/sbbs/-/commit/0a78d39dd2e3389140dff826
Modified Files:
src/syncterm/ripper.c
Log Message:
Fix handling of broken CRLF pairs in RIP mode

If telnet binary mode is enabled (the new default), and a CR and LF
come in on separate recv() calls, the RIP parser would stop at the
CR, and pass the LF back to the ANSI parser.

Ah, dura-bbs.net, always pushing the limits.
--- SBBSecho 3.20-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

https://gitlab.synchro.net/main/sbbs/-/commit/9b3aa58cf998d1c1015560b3
Modified Files:
src/syncterm/ripper.c
Log Message:
Fix up previous commit

RIPtel reset to the font configured by the user, not the current
font. Do the same here.
--- SBBSecho 3.20-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

https://gitlab.synchro.net/main/sbbs/-/commit/d48528a74ff6605ef1f7aee0
Modified Files:
src/syncterm/ripper.c
Log Message:
Just because we're *compiled* with graphics support doesn't mean
we support them in the current mode.

Fixes issue 175
--- SBBSecho 3.23-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

https://gitlab.synchro.net/main/sbbs/-/commit/ea4f8b4efe0a8e5e837398c5
Modified Files:
src/syncterm/ripper.c
Log Message:
Eliminate a couple more Coverity issues via temporary variables.

This gets the assignment to the rip.* members out of the lock so
Coverity doesn't assume they need to be protected by the lock.

It should compile to the same thing.
--- SBBSecho 3.23-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

https://gitlab.synchro.net/main/sbbs/-/commit/6f8678eb9e0d40dd72a0897e
Modified Files:
src/syncterm/ripper.c
Log Message:
"Range check" RIP ICN width/height to untaint them.

This is purely to shut up Coverity since there's no way the value
could be outside the range.
--- SBBSecho 3.23-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

https://gitlab.synchro.net/main/sbbs/-/commit/a98f8a44c3429b19fbef6803
Modified Files:
src/syncterm/ripper.c
Log Message:
Fix a memory leak and an allowed out-of-bounds access.

Thanks Coverity!
--- SBBSecho 3.23-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

https://gitlab.synchro.net/main/sbbs/-/commit/444fecaf4af203b773ca5833
Modified Files:
src/syncterm/ripper.c
Log Message:
Add unreachable code

Coverity thinks it can do the default case.
--- SBBSecho 3.23-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

https://gitlab.synchro.net/main/sbbs/-/commit/a64e68143b0c192a44a840ff
Modified Files:
src/syncterm/ripper.c
Log Message:
Do the lock assertion thing in ripper.c too.
--- SBBSecho 3.23-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

https://gitlab.synchro.net/main/sbbs/-/commit/f41de9a1f41359c845de5371
Modified Files:
src/syncterm/ripper.c
Log Message:
Now that vstat.vmem has more stuff, ripper needs to hack up more.

Fixes assertion/crash in 91-column mode (used in LORD intro screens)
--- SBBSecho 3.23-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

https://gitlab.synchro.net/main/sbbs/-/commit/2aac6ec016aa3629c643e019
Modified Files:
src/syncterm/ripper.c
Log Message:
Initialize the *new* memory, not the old stuff.

Fixes various memory corruptions with RIP
--- SBBSecho 3.23-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

https://gitlab.synchro.net/main/sbbs/-/commit/c464596b33610cc1683b69fd
Modified Files:
src/syncterm/ripper.c
Log Message:
Work around what appears to be an integer promotion issue

On an aarch64 Chromebook running gcc 12.2.0, these would wrap in
weird ways causing vector fonts to be positioned incorrectly.

It managed to say that (25 - -7) * 4 / 3 == -168
This casting dance appears to resolve the issue.
--- SBBSecho 3.23-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

https://gitlab.synchro.net/main/sbbs/-/commit/a97b1adad05bc8aec50278bf
Modified Files:
src/syncterm/ripper.c
Log Message:
Fix possibly undefined value in ellipse.

Top-right quadrant doesn't need a quadrant angle, the angle is what
we want already.
--- SBBSecho 3.23-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

https://gitlab.synchro.net/main/sbbs/-/commit/09b2157307bcfb080f0357a8
Modified Files:
src/syncterm/ripper.c
Log Message:
Attempt to silence false positive warning.

The warning suggests that x1 and y1 may be uninitialized in the i > 0
block, but that's not really possible...

It's too bad the warning doesn't clarify. It's also weird that the
warning was in the draw_line() call and not in the lines above that (incorrectly) compared them with -1.

Fix that check while we're here.
--- SBBSecho 3.23-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

https://gitlab.synchro.net/main/sbbs/-/commit/f73b6e394587333ffd76521c
Modified Files:
src/syncterm/ripper.c
Log Message:
Parse RIP_NO_MORE in RIP_STATE_PIPE, not RIP_STATE_CMD

This will likely screw up on !|0#, but hopefully nobody has ever done
that.

Fixes ticket 218
--- SBBSecho 3.37-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

https://gitlab.synchro.net/main/sbbs/-/commit/27e6a20fa2b8661b46668d88
Modified Files:
src/syncterm/ripper.c
Log Message:
Fix new potential RIP crash

Would potentially use a negative length after a |#
--- SBBSecho 3.37-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

https://gitlab.synchro.net/main/sbbs/-/commit/bb2238f684befe43deb34cea
Modified Files:
src/syncterm/ripper.c
Log Message:
Fix heap buffer overflows in ripper.c RIPscrip command handling

Four strcat() calls append RIPscrip arguments (from the remote server)
to cache_path[MAX_PATH+1] without checking whether the result fits.
The path-traversal guards reject "..", "/", and "\" but do not limit
length. A long filename from a malicious RIPscrip server overflows
the buffer.

Changed to strlcat(cache_path, ..., sizeof(cache_path)) at all four
sites: file-query (&args[6]), icon-load (&args[9] + ".ICN"), and
icon-save (&args[1]). The existing SkyPix download path already had
a strlen() guard and was not affected.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
--- SBBSecho 3.37-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

https://gitlab.synchro.net/main/sbbs/-/commit/2054747bb2823818ea5d1a0d
Modified Files:
src/syncterm/ripper.c
Log Message:
Fix multiple ripper.c security and correctness bugs

Security fixes:
- Add path traversal checks (..//\) to LOAD_ICON, WRITE_ICON,
ENTER_BLOCK_MODE, and font file loading
- Add overflow guard for ICN pixel buffer allocation (32-bit)
- Clamp viewport coordinates to world frame dimensions
- Cap handle_command_str recursion depth to 64
- Fix sprintf stack overflow in FILE_QUERY case 4 (snprintf)
- Guard parse_string NULL return in do_rip_command
- Guard strdup NULL return in bicmp

Correctness fixes:
- Remove incorrect viewport offsets from EXTENDED_TEXT_WINDOW (v2+)
- Fix MOUSE hot field y2 using viewport.sx instead of .sy
- Fix POLY_LINE y1 init using x_dim instead of y_dim
- Fix conn_send length for FILE_QUERY \r\n responses (2 -> 3)
- Fix draw_pixel XOR mode memory leak (freepixels before return)
- Fix ansi_only() missing break before fall-through
- Reject zero dimensions in SET_WORLD_FRAME
- Clamp do_popup dimensions to screen size
- Fix init_rip_ver memory leaks (mouse fields, clipboard, scb)
- Add Amiga font file validation at load time
- Add per-case argc checks in do_skypix
- Handle realloc failure in reinit_screen gracefully
- Add NULL checks for getpixels in set_line and flood fill

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
--- SBBSecho 3.37-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

https://gitlab.synchro.net/main/sbbs/-/commit/5ca54e09393c1068e32e599f
Modified Files:
src/syncterm/ripper.c
Log Message:
Fix draw_button() off-by-one errors for exclusive box coordinates

box.x2/y2 are exclusive (one past end), so:
- Sunken border right/bottom highlight lines drew one pixel too far out
- Recessed border width/height were one pixel too large, pushing the
outer border off-screen for full-width buttons

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
--- SBBSecho 3.37-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

https://gitlab.synchro.net/main/sbbs/-/commit/679e5bae93abe08984256ab6
Modified Files:
src/syncterm/ripper.c
Log Message:
With the help of Claude, exactly match RIPTERM ellipses

I had assumed they used McIlroy for Ellipses, so could only get
close... they had actually used the two-region Bresenham, the reason
I didn't get that to match was that they apparently scale by 100 to
"avoid rounding", so my truncation was wildly different.
--- SBBSecho 3.37-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

https://gitlab.synchro.net/main/sbbs/-/commit/d1c27d856bf669d666f637a8
Modified Files:
src/syncterm/ripper.c
Log Message:
And fix arcs too!

We actually needed to extract the trig tables BGI uses to get this
to work out right... fighting with floating point was not the way.
--- SBBSecho 3.37-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

https://gitlab.synchro.net/main/sbbs/-/commit/7e79e2c43826ac8dedb24347
Modified Files:
src/syncterm/ripper.c
Log Message:
Much better bezier match

replace per-iteration step/cnt division with accumulated
t += 1.0/cnt.

This produces the SAME ERROR I see from the RIPterm across obvious
test vectors.

The old code was "too correct", RIPterm appears to accumulate error
and never correct for it.
--- SBBSecho 3.37-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

https://gitlab.synchro.net/main/sbbs/-/commit/81b7dd81d2a640500ae7961f
Modified Files:
src/syncterm/ripper.c
Log Message:
Mostly cleanup stuff...

Clean up old use of a hack bit, use the new polyfill for the RIP
command, clean up some comments, and get XOR working properly
everywhere.
--- SBBSecho 3.37-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

https://gitlab.synchro.net/main/sbbs/-/commit/179725429e08522795487d5f
Modified Files:
src/syncterm/ripper.c
Log Message:
Some more button fixups.

1. !|1U missing <res> field - no longer draws the button (per RIPterm)
2. Recessed inner corner pixels - removed explicit cc-colored corner
pixels on inner recess border (RIPterm lets the bg lines overlap naturally) 3. Chisel inset height off-by-one — y2 - y1 + 1 → y2 - y1 since box.y2 is
exclusive
--- SBBSecho 3.37-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

https://gitlab.synchro.net/main/sbbs/-/commit/fadd8eb62fe426eee68a0964
Modified Files:
src/syncterm/ripper.c
Log Message:
Handle thick ellipses better.

It looks like when drawing a thick ellipse, it draws multiple thick
line segments. Now that we have the Borland cos/sin tables, we can
do that ourselves as a special case.
--- SBBSecho 3.37-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

https://gitlab.synchro.net/main/sbbs/-/commit/9684acff780621441b3c1194
Modified Files:
src/syncterm/ripper.c
Log Message:
Fix parse_mega() buffer overreads

Many places were calling parse_mega() without checking the return
value, then calling parse_mega() on the string AFTER the previous
one. This means that on truncated invalid RIP sequences, ripper
would read past the end of the allocation.

This fix was complicated by the fact that the "last" item in a
parameter list can be truncated as long as it has at least one
valid byte in it.

This now uses a vararg function and parses them all at once (mostly).
--- SBBSecho 3.37-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

https://gitlab.synchro.net/main/sbbs/-/commit/87ddc4046f27a9c51592941d
Modified Files:
src/syncterm/ripper.c
Log Message:
More fixes.

RIPterm doesn't render \x0e or \x0f at all. (perseid.rip)
Fixed size is ALWAYS used for plain buttons.
Fix stroked-font tabs.
The actual movement after a glyph is drawn comes from the stroke
data, NOT the width data. In SANS.CHR at least, the table has TAB
with a width of 0, but it's actually 24 based on the stroke.
Only use npoints for |p, |P, and |l
--- SBBSecho 3.37-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

https://gitlab.synchro.net/main/sbbs/-/commit/2b59a74912e34419e35217eb
Modified Files:
src/syncterm/ripper.c
Log Message:
More RIP tweaks

Correctly handle the "selected" flag.
This also makes selecting buttons match the RIPterm rendering.

Support "highlight icon" buttons.
This is what you're expected to use with radio buttons and checkboxen

Fix paste clipping
It clips at the bottom of the screen, rejects at the right.
--- SBBSecho 3.37-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

https://gitlab.synchro.net/main/sbbs/-/commit/412fcb168c8a5e4a7854d93c
Modified Files:
src/syncterm/ripper.c
Log Message:
Add support for justified text.

Bug-compatible with RIPterm as usual.
--- SBBSecho 3.37-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

https://gitlab.synchro.net/main/sbbs/-/commit/3c9429e9b886b357504661bb
Modified Files:
src/syncterm/ripper.c
Log Message:
Fix whitespace
--- SBBSecho 3.37-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

https://gitlab.synchro.net/main/sbbs/-/commit/3f3da7f1f946bc833f8c5763
Modified Files:
src/syncterm/ripper.c
Log Message:
Remove segment/offset references from comments.
--- SBBSecho 3.37-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

https://gitlab.synchro.net/main/sbbs/-/commit/d00fb8a5a903062bed9355bb
Modified Files:
src/syncterm/ripper.c
Log Message:
Fix build for SyncVIEW
--- SBBSecho 3.37-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

https://gitlab.synchro.net/main/sbbs/-/commit/97b24908022f8f9b66219660
Modified Files:
src/syncterm/ripper.c
Log Message:
Don't set values that end up never used.
--- SBBSecho 3.37-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

https://gitlab.synchro.net/main/sbbs/-/commit/60a1729c6607cc6dfbd4083f
Modified Files:
src/syncterm/ripper.c
Log Message:
Handle malloc() failure loading icons.
--- SBBSecho 3.37-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

https://gitlab.synchro.net/main/sbbs/-/commit/9aec986dd3fceff2900775a6
Modified Files:
src/syncterm/ripper.c
Log Message:
Fix up arc_collect usage.

size_t where appropriate, handle realloc() correctly.
--- SBBSecho 3.37-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

https://gitlab.synchro.net/main/sbbs/-/commit/6f4e66c29f1828368daf9835
Modified Files:
src/syncterm/ripper.c
Log Message:
Fix possible strdup(NULL)
--- SBBSecho 3.37-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

https://gitlab.synchro.net/main/sbbs/-/commit/d626b0ea46f25e95455be770
Modified Files:
src/syncterm/ripper.c
Log Message:
Some more type twiddling
--- SBBSecho 3.37-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

https://gitlab.synchro.net/main/sbbs/-/commit/37b929e00df0ace04dcdac0b
Modified Files:
src/syncterm/ripper.c
Log Message:
Fix invalid ESC buffer expansion/stuffing
--- SBBSecho 3.37-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

https://gitlab.synchro.net/main/sbbs/-/commit/846d51fe947ce8e276793f2e
Modified Files:
src/syncterm/ripper.c
Log Message:
Save/restore CTerm receive callback when reiniting

Otherwise ANSI responses stop flowing back to the BBS in RIP mode.
--- SBBSecho 3.37-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

https://gitlab.synchro.net/main/sbbs/-/commit/9c50d542280c470b42f8c236
Modified Files:
src/syncterm/ripper.c
Log Message:
Save font when drawing buttons and use it.

Black Flag RIP menus changed fonts after drawing buttons, and that
made things look bad.
--- SBBSecho 3.37-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

https://gitlab.synchro.net/main/sbbs/-/commit/6147bc695c037df28bc4c6e4
Modified Files:
src/syncterm/ripper.c
Log Message:
Avoid implying to Coverity that rip.stw.size belongs in a mutex
--- SBBSecho 3.37-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

https://gitlab.synchro.net/main/sbbs/-/commit/fadf3dfffe8df12876c622b1
Modified Files:
src/syncterm/ripper.c
Log Message:
Fix some Coverity warnings.
--- SBBSecho 3.37-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

https://gitlab.synchro.net/main/sbbs/-/commit/4a72a5fa65458b2f2df810d9
Modified Files:
src/syncterm/ripper.c
Log Message:
We define our own M_PI now.
--- SBBSecho 3.37-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)