vmiklos/bitlbee — pull request #6 by mk-fg (2013-02-07 07:50:29+00:00)
Title: skype: check for truncated commands on receiving

Kinda related to #5, but works for the other side.

Again, problem arises from the simple fact of [what stream sockets are](http://www.unixguide.net/network/socketfaq/2.11.shtml) - just two buffers on both sides app writes to, but which can shuttle data between themselves in any chunks.
They don't deal with "messages" in this case (non-stream sockets can - DBus does, ZeroMQ does, etc, and the "messages" part is the whole point there, as they work on top of tcp/unix streams), only infinite data streams.

That's the reason why received buffer of IRC_LINE_SIZE is likely to contain truncated lines at the end - only case when it won't is when sent lines fit *exactly* into IRC_LINE_SIZE, which I think is one in a million chance with free-form lines skype.so/skyped are dealing with.

So basically, proposed patch is not a fix (proper fix would be to buffer incomplete data at the end and prepend it to what next recv() produce), but it's a sanity check to prevent random behavior and potential security issues.
Imagine someone sending line of 1024-bytes + "DO STUFF ..." command after these bytes - user might see harmless message while other command after it will be interpreted as trusted skype/skyped protocol command doing whatever it can.