2 files changed, 64 insertions, 46 deletions

diff --git a/testing/toxic/chat.c b/testing/toxic/chat.c
index a0a4b576..32c05dec 100644
--- a/testing/toxic/chat.c
+++ b/testing/toxic/chat.c
@@ -236,7 +236,7 @@ void execute(ToxWindow *self, ChatContext *ctx, Messenger *m, char *cmd)
     wattroff(ctx->history, COLOR_PAIR(2));
 
     uint8_t selfname[MAX_NAME_LENGTH];
-    int len = getself_name(m, selfname);
+    int len = getself_name(m, selfname, sizeof(selfname));
     char msg[MAX_STR_SIZE-len-4];
     snprintf(msg, sizeof(msg), "* %s %s\n", (uint8_t*) selfname, action);
 
diff --git a/testing/toxic/configdir.c b/testing/toxic/configdir.c
index 6cbb06bc..18e211ce 100644
--- a/testing/toxic/configdir.c
+++ b/testing/toxic/configdir.c
@@ -28,65 +28,83 @@
 #ifdef WIN32
 #include <shlobj.h>
 #include <direct.h>
-#endif
-
-#ifdef __APPLE__
+#else /* WIN32 */
 #include <unistd.h>
 #include <pwd.h>
-#endif
+#endif /* WIN32 */
 
 #include "configdir.h"
 
-/*
- * Retrieves a correct configuration directory, depending on the OS used, with a trailing slash
+/**
+ * @brief Get the users config directory.
+ *
+ * This is without a trailing slash.
+ *
+ * @return The users config dir or NULL on error.
  */
 char *get_user_config_dir(void)
 {
-  char *user_config_dir;
+    char *user_config_dir;
+#ifdef WIN32
+    char appdata[MAX_PATH];
+    BOOL ok;
 
-  #ifdef WIN32
+    ok = SHGetSpecialFolderPathA(NULL, appdata, CSIDL_PROFILE, TRUE);
+    if (!ok) {
+        return NULL;
+    }
 
-  char appdata[MAX_PATH];
-  HRESULT result = SHGetFolderPath(
-    NULL,
-    CSIDL_APPDATA,
-    NULL,
-    SHGFP_TYPE_CURRENT,
-    appdata
-  )
-  if (!result) return NULL;
-
-  user_config_dir = strdup(appdata);
-
-  return user_config_dir;
-
-  #elif defined __APPLE__
-
-  struct passwd *pass = getpwuid(getuid());
-  if (!pass) return NULL;
-  char *home = pass->pw_dir;
-  user_config_dir = malloc(strlen(home) + strlen("/Library/Application Support") + 1);
-  
-  if(user_config_dir) {
-    strcpy(user_config_dir, home);
-    strcat(user_config_dir, "/Library/Application Support");
-  }
-  return user_config_dir;
+    user_config_dir = strdup(appdata);
+
+    return user_config_dir;
+
+#else /* WIN32 */
+
+#ifndef NSS_BUFLEN_PASSWD
+#define NSS_BUFLEN_PASSWD 4096
+#endif /* NSS_BUFLEN_PASSWD */
+
+    struct passwd pwd;
+    struct passwd *pwdbuf;
+    const char *home;
+    char buf[NSS_BUFLEN_PASSWD];
+    size_t len;
+    int rc;
+
+    rc = getpwuid_r(getuid(), &pwd, buf, NSS_BUFLEN_PASSWD, &pwdbuf);
+    if (rc == 0) {
+        home = pwd.pw_dir;
+    } else {
+        home = getenv("HOME");
+        if (home == NULL) {
+            return NULL;
+        }
+        /* env variables can be tainted */
+        snprintf(buf, sizeof(buf), "%s", home);
+        home = buf;
+    }
 
-  #else
+# if defined(__APPLE__)
+    len = strlen(home) + strlen("/Library/Application Support") + 1;
+    user_config_dir = malloc(len);
+    if (user_config_dir == NULL) {
+        return NULL;
+    }
 
-  if (getenv("XDG_CONFIG_HOME")) {
-    user_config_dir = strdup(getenv("XDG_CONFIG_HOME"));
-  } else {
-    user_config_dir = malloc(strlen(getenv("HOME")) + strlen("/.config") + 1);
-    if (user_config_dir) {
-      strcpy(user_config_dir, getenv("HOME"));
-      strcat(user_config_dir, "/.config");
+    snprintf(user_config_dir, len, "%s/Library/Application Support", home);
+# else /* __APPLE__ */
+    len = strlen(home) + strlen("/.config") + 1;
+    user_config_dir = malloc(len);
+    if (user_config_dir == NULL) {
+        return NULL;
     }
-  }
-  return user_config_dir;
 
-  #endif
+    snprintf(user_config_dir, len, "%s/.config", home);
+# endif /* __APPLE__ */
+
+    return user_config_dir;
+#undef NSS_BUFLEN_PASSWD
+#endif /* WIN32 */
 }
 
 /*