fix a possible buffer overflow and division by 0

Author: cen1

src/bncsutil/bsha1.cpp

@@ -143,10 +143,10 @@ MEXP(void) calcHashBuf(const char* input, size_t length, char* result) {
     int i;
     uint32_t a, b, c, d, e, g;
     uint32_t* ldata;
-    char data[1024];
-    memset(data, 0, 1024);
+    uint32_t data[256];
+    memset(data, 0, sizeof(data));
     memcpy(data, input, length);
-    ldata = (uint32_t*) data;
+    ldata = data;
 
     for (i = 0; i < 64; i++) {
         ldata[i + 16] =
@@ -207,12 +207,11 @@ MEXP(void) calcHashBuf(const char* input, size_t length, char* result) {
     BSHA_OP4(a, b, c, d, e, *ldata++, g) BSHA_OP4(a, b, c, d, e, *ldata++, g)
     BSHA_OP4(a, b, c, d, e, *ldata++, g) BSHA_OP4(a, b, c, d, e, *ldata++, g)
 
-    ldata = (uint32_t*) result;
-    ldata[0] = LSB4(BSHA_IC1 + a);
-    ldata[1] = LSB4(BSHA_IC2 + b);
-    ldata[2] = LSB4(BSHA_IC3 + c);
-    ldata[3] = LSB4(BSHA_IC4 + d);
-    ldata[4] = LSB4(BSHA_IC5 + e);
-    ldata = NULL;
+    uint32_t tmp;
+    tmp = LSB4(BSHA_IC1 + a); memcpy(result +  0, &tmp, 4);
+    tmp = LSB4(BSHA_IC2 + b); memcpy(result +  4, &tmp, 4);
+    tmp = LSB4(BSHA_IC3 + c); memcpy(result +  8, &tmp, 4);
+    tmp = LSB4(BSHA_IC4 + d); memcpy(result + 12, &tmp, 4);
+    tmp = LSB4(BSHA_IC5 + e); memcpy(result + 16, &tmp, 4);
 }
 #endif

src/bncsutil/cdkeydecoder.cpp

@@ -140,7 +140,8 @@ CDKeyDecoder::CDKeyDecoder(const char* cdKey, size_t keyLength) {
     cdkey = new char[keyLength + 1];
     initialized = 1;
     keyLen = keyLength;
-    strcpy(cdkey, cdKey);
+    memcpy(cdkey, cdKey, keyLength);
+    cdkey[keyLength] = '\0';
 
     switch (keyType) {
         case KEY_STARCRAFT:

src/bncsutil/checkrevision.cpp

@@ -291,6 +291,7 @@ MEXP(int) checkRevision(const char* formula, const char* files[], int numFiles,
                         break;
                     case '/':
                         // well, you never know
+                        if (values[ovs2[k]] == 0) return 0;
                         values[ovd[k]] = values[ovs1[k]] / values[ovs2[k]];
                         break;
                     default: