https://gitlab.synchro.net/main/sbbs/-/commit/a921e071e97e64135b6d628a
Modified Files:
src/sbbs3/chat.cpp useredit.cpp
Log Message:
uedit/chat: don't mistake a ctrl-c for a number entry (CID 652885)
getkeys() returns -1 on ctrl-c, abort, or disconnect, and value|0x80000000
for a typed number. Both callers tested only "x & 0x80000000L". On LP64 that literal is a 64-bit long, so an int -1 sign-extends and the test is true: the abort is read as a number.
In useredit() that set user.number to 2147483647 and looped instead of
leaving the editor. The (ushort) cast dropped in 62f96a750b (hawk-27-disc, 2026-08-09) had been narrowing the result to 65535, which is why the defect only became visible to the analyzer now.
In multinodechat() the / command left savch == -1 and called chan_access(-2), reading cfg.chan[] out of bounds; chan_access() bounded cnum from above only, so it now rejects a negative channel too.
Guard both call sites the way readmsgs.cpp and readmail.cpp already do. scansubs.cpp shares the idiom but checks s == -1 after every getkeys().
Co-Authored-By: Claude Opus 5 (1M context) <
noreply@anthropic.com>
---
■ Synchronet ■ Vertrauen ■ Home of Synchronet ■ [vert/cvs/bbs].synchro.net
Web-based telnet client
DOS games (playable from your web browser)
IRC
Email & news access