fix-fortify-snprintf.patch

From: psg <andreathorne78@gmail.com>
Subject: Fix buffer overflow detected by _FORTIFY_SOURCE in snprintf calls

Two snprintf() calls in parse.c pass sizeof(buf) as the size argument
while writing to an offset within the buffer (&buf[strlen(buf)]).
glibc's _FORTIFY_SOURCE=3 detects this at runtime via
__builtin_dynamic_object_size and aborts with "buffer overflow detected".

The first (in p_channel) triggers reliably on every channel join.

Fix: subtract strlen(buf) from the size argument so only the remaining
space is reported.

--- a/source/parse.c
+++ b/source/parse.c
@@ -1286,7 +1286,7 @@ p_channel(from, ArgList)
                             if (chan && chan->gotwho) *tmpbuf = '\0';
                             else snprintf(tmpbuf,sizeof(tmpbuf), "WHO %s", channel);
                             if (*channel != '+') {
-                                snprintf(&tmpbuf[strlen(tmpbuf)], sizeof(tmpbuf),
+                                snprintf(&tmpbuf[strlen(tmpbuf)], sizeof(tmpbuf) - strlen(tmpbuf),
                                         "\r\nMODE %s\r\nMODE %s e\r\nMODE %s b",
                                         channel, channel, channel);
                             }
@@ -1897,7 +1897,7 @@ p_part(from, ArgList)

                             snprintf(tmpbuf2, sizeof(tmpbuf2), "%s has left channel %s", from, channel);
                             if (comment && *comment)
-                                snprintf(&tmpbuf2[strlen(tmpbuf2)], sizeof(tmpbuf2), "(%s)", comment);
+                                snprintf(&tmpbuf2[strlen(tmpbuf2)], sizeof(tmpbuf2) - strlen(tmpbuf2), "(%s)", comment);
                             ChannelLogSave(tmpbuf2, chan);
                         }
                     }