From 0c080b3982fbfd89db3cbc72a7fba0ffa9899f24 Mon Sep 17 00:00:00 2001
From: Bram Matthys <syzop@vulnscan.org>
Date: Sat, 25 Apr 2020 09:26:56 +0200
Subject: [PATCH] Fix crash in tkldb on 32 bit systems. Reported by k4be. Also,
 get rid of compiler warnings (we can use C99 types now).

---
 src/api-clicap.c    |  2 +-
 src/modules/tkldb.c | 12 ++++++++----
 src/user.c          |  2 +-
 3 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/src/api-clicap.c b/src/api-clicap.c
index ea0a19096..6d4139e21 100644
--- a/src/api-clicap.c
+++ b/src/api-clicap.c
@@ -101,7 +101,7 @@ long clicap_allocate_cap(void)
 	long v = 1;
 	ClientCapability *clicap;
 
-	for (v=1; v < 2147483648; v = v * 2)
+	for (v=1; v < LONG_MAX; v = v * 2)
 	{
 		unsigned char found = 0;
 		for (clicap = clicaps; clicap; clicap = clicap->next)
diff --git a/src/modules/tkldb.c b/src/modules/tkldb.c
index 0e0ef1807..89cfedb7e 100644
--- a/src/modules/tkldb.c
+++ b/src/modules/tkldb.c
@@ -402,9 +402,10 @@ int read_tkldb(void)
 	FILE *fd;
 	TKL *tkl = NULL;
 	uint32_t magic = 0;
+	uint32_t version;
 	uint64_t cnt;
 	uint64_t tklcount = 0;
-	uint32_t version;
+	uint64_t v;
 	int added_cnt = 0;
 	char c;
 	char *str;
@@ -483,8 +484,10 @@ int read_tkldb(void)
 
 		/* Read the common types (same for all TKLs) */
 		R_SAFE(read_str(fd, &tkl->set_by));
-		R_SAFE(read_int64(fd, &tkl->set_at));
-		R_SAFE(read_int64(fd, &tkl->expire_at));
+		R_SAFE(read_int64(fd, &v));
+		tkl->set_at = v;
+		R_SAFE(read_int64(fd, &v));
+		tkl->expire_at = v;
 
 		/* Save some CPU... if it's already expired then don't bother adding */
 		if (tkl->expire_at != 0 && tkl->expire_at <= TStime())
@@ -645,7 +648,8 @@ int read_tkldb(void)
 			}
 
 			R_SAFE(read_str(fd, &tkl->ptr.spamfilter->tkl_reason));
-			R_SAFE(read_int64(fd, &tkl->ptr.spamfilter->tkl_duration));
+			R_SAFE(read_int64(fd, &v));
+			tkl->ptr.spamfilter->tkl_duration = v;
 
 			if (find_tkl_spamfilter(tkl->type, tkl->ptr.spamfilter->match->str,
 			                        tkl->ptr.spamfilter->action,
diff --git a/src/user.c b/src/user.c
index 8baf29e69..c43c28c9d 100644
--- a/src/user.c
+++ b/src/user.c
@@ -124,7 +124,7 @@ long set_usermode(char *umode)
 /** Convert a target pointer to an 8 bit hash, used for target limiting. */
 unsigned char hash_target(void *target)
 {
-	unsigned long long v = (unsigned long long)target;
+	uintptr_t v = (uintptr_t)target;
 	/* ircu does >> 16 and 8 but since our sizeof(Client) is
 	 * towards 512 (and hence the alignment), that bit is useless.
 	 * So we do >> 17 and 9.