core: add limits for buffers (max 10000 buffers opened, number of a buffer: between 1 and INT_MAX - 10000)

3 files changed, 69 insertions, 11 deletions

diff --git a/src/core/wee-command.c b/src/core/wee-command.c
index f9f5f9ab9..ed5eceed5 100644
--- a/src/core/wee-command.c
+++ b/src/core/wee-command.c
@@ -474,6 +474,35 @@ COMMAND_CALLBACK(bar)
 }
 
 /*
+ * Checks if the buffer number is valid (in range 1 to GUI_BUFFER_NUMBER_MAX).
+ *
+ * If the number is not valid, a warning is displayed.
+ *
+ * Returns:
+ *   1: buffer number is valid
+ *   0: buffer number is invalid
+ */
+
+int
+command_buffer_check_number (long number)
+{
+    if ((number < 1) || (number > GUI_BUFFER_NUMBER_MAX))
+    {
+        /* invalid number */
+        gui_chat_printf (NULL,
+                         _("%sError: buffer number %d is out of range "
+                           "(it must be between 1 and %d)"),
+                         gui_chat_prefix[GUI_CHAT_PREFIX_ERROR],
+                         number,
+                         GUI_BUFFER_NUMBER_MAX);
+        return 0;
+    }
+
+    /* number is OK */
+    return 1;
+}
+
+/*
  * Displays a local variable for a buffer.
  */
 
@@ -593,7 +622,9 @@ COMMAND_CALLBACK(buffer)
         }
         else if (strcmp (argv[2], "+") == 0)
         {
-            gui_buffer_move_to_number (buffer, last_gui_buffer->number + 1);
+            number = last_gui_buffer->number + 1;
+            if (command_buffer_check_number (number))
+                gui_buffer_move_to_number (buffer, number);
         }
         else
         {
@@ -601,16 +632,16 @@ COMMAND_CALLBACK(buffer)
             number = strtol (((argv[2][0] == '+') || (argv[2][0] == '-')) ?
                              argv[2] + 1 : argv[2],
                              &error, 10);
-            if (error && !error[0])
+            if (error && !error[0]
+                && (number >= INT_MIN) && (number <= INT_MAX))
             {
                 if (argv[2][0] == '+')
-                    gui_buffer_move_to_number (buffer,
-                                               buffer->number + ((int) number));
+                    number = buffer->number + number;
                 else if (argv[2][0] == '-')
-                    gui_buffer_move_to_number (buffer,
-                                               buffer->number - ((int) number));
-                else
-                    gui_buffer_move_to_number (buffer, (int) number);
+                    number = buffer->number - number;
+                number = (int)number;
+                if (command_buffer_check_number (number))
+                    gui_buffer_move_to_number (buffer, number);
             }
             else
             {
@@ -700,7 +731,8 @@ COMMAND_CALLBACK(buffer)
                 }
             }
         }
-        gui_buffer_unmerge (buffer, (int)number);
+        if (command_buffer_check_number ((int)number))
+            gui_buffer_unmerge (buffer, (int)number);
 
         return WEECHAT_RC_OK;
     }
@@ -738,8 +770,11 @@ COMMAND_CALLBACK(buffer)
          * renumber the buffers; if we are renumbering all buffers (no numbers
          * given), start at number 1
          */
-        gui_buffer_renumber (numbers[0], numbers[1],
-                             (argc == 2) ? 1 : numbers[2]);
+        if ((argc == 2) || command_buffer_check_number ((int)numbers[2]))
+        {
+            gui_buffer_renumber ((int)numbers[0], (int)numbers[1],
+                                 (argc == 2) ? 1 : (int)numbers[2]);
+        }
         return WEECHAT_RC_OK;
     }
 
diff --git a/src/gui/gui-buffer.c b/src/gui/gui-buffer.c
index ad4645f49..daae4f8d6 100644
--- a/src/gui/gui-buffer.c
+++ b/src/gui/gui-buffer.c
@@ -492,6 +492,16 @@ gui_buffer_new (struct t_weechat_plugin *plugin,
         return NULL;
     }
 
+    if (gui_buffers_count >= GUI_BUFFERS_MAX)
+    {
+        gui_chat_printf (NULL,
+                         _("%sError: maximum number of buffers is reached "
+                           "(%d)"),
+                         gui_chat_prefix[GUI_CHAT_PREFIX_ERROR],
+                         GUI_BUFFERS_MAX);
+        return NULL;
+    }
+
     /* create new buffer */
     new_buffer = malloc (sizeof (*new_buffer));
     if (!new_buffer)
@@ -2611,6 +2621,8 @@ gui_buffer_renumber (int number1, int number2, int start_number)
 
     if (start_number < 1)
         start_number = ptr_first_buffer->number;
+    else if (start_number > GUI_BUFFER_NUMBER_MAX)
+        start_number = GUI_BUFFER_NUMBER_MAX;
 
     /* the start number must be greater than buffer before first buffer */
     if (ptr_first_buffer->prev_buffer
@@ -2676,6 +2688,9 @@ gui_buffer_move_to_number (struct t_gui_buffer *buffer, int number)
     if (number < 1)
         number = 1;
 
+    if (number > GUI_BUFFER_NUMBER_MAX)
+        number = GUI_BUFFER_NUMBER_MAX;
+
     /* buffer number is already OK ? */
     if (number == buffer->number)
         return;
@@ -2998,6 +3013,9 @@ gui_buffer_unmerge (struct t_gui_buffer *buffer, int number)
 
     ptr_new_active_buffer = NULL;
 
+    if (number > GUI_BUFFER_NUMBER_MAX)
+        number = GUI_BUFFER_NUMBER_MAX;
+
     /* by default, we move buffer to buffer->number + 1 */
     if ((number < 1)  || (number == buffer->number))
     {
diff --git a/src/gui/gui-buffer.h b/src/gui/gui-buffer.h
index ae36d14d3..5057eb68c 100644
--- a/src/gui/gui-buffer.h
+++ b/src/gui/gui-buffer.h
@@ -20,6 +20,7 @@
 #ifndef __WEECHAT_GUI_BUFFER_H
 #define __WEECHAT_GUI_BUFFER_H 1
 
+#include <limits.h>
 #include <regex.h>
 
 struct t_hashtable;
@@ -46,6 +47,10 @@ enum t_gui_buffer_notify
 
 #define GUI_BUFFER_MAIN "weechat"
 
+#define GUI_BUFFERS_MAX 10000
+
+#define GUI_BUFFER_NUMBER_MAX (INT_MAX - 10000)
+
 #define GUI_TEXT_SEARCH_DISABLED 0
 #define GUI_TEXT_SEARCH_BACKWARD 1
 #define GUI_TEXT_SEARCH_FORWARD  2