BOF gtmess <= 0.96

src/client/msn.h:30:

#define SML 512

src/client/nserver.h:29:

typedef struct {
 /* must be set by user */
 char login[SML], pass[SML];
 char notaddr[SML];

 /* personal state */
 char nick[SML];
 char psm[SML];
 msn_stat_t status;
 int inbox, folders;
 /* privacy mode */
 char BLP; /* all other users: (A)llow; (B)lock */
 char GTC; /* prompt when other users add you: (A)lways; (N)ever */
 /* lists */
 msn_glist_t GL; /* group list */
 msn_clist_t CL; /* contact list (forward, reverse, allow, block) */

 char hlogin[SML]; /* highlighted contact in CL */
 char hgid[SNL];         /* highlighted group in CL */
 int dhid;          /* delta pos. of highlighted contact */

 /*msn_clist_t IL; /* initial status list */
 /* unsigned int SYN; /* syn list version */
 int list_count; /* number of LST responses */

int flskip; /* FL list line skip (for display) */
 pthread_mutex_t lock;

 FILE *fp_log; /* log file pointer */
 char fn_log[SML]; /* log file name */


 /* session */
 unsigned int tid;
 int nfd;
 int in_syn; /* SYN in progress */
 pthread_t thrid;
} msn_t;

Largo máximo del usuario reservado: 512


src/client/gtmess.c:2081:

        if (!(r = get_string(C_EBX, 0, "Login as: ", msn.login, SML))) return 0;
     if (r == 1) {
         if (strchr(msn.login, '@') == NULL) strcat(msn.login, "@hotmail.com");
         Strcpy(msn.nick, msn.login, SML);
         msn.pass[0] = 0;
         draw_status(1);
     }

que básicamente seria, colocar 512 caracteres (sin @), el sistema los leerá, pero al llegar a esta ultima parte se concatenaría "@hotmail.com" (12 bytes) y eso causaría el desborde.

Nota: bug inicialmente observado por "HacKeRsr", analizado y explotado por Xianur0.