escape any % format specifiers we recieve from clients

ChangeLog

@@ -4,6 +4,8 @@ Anything we add/remove/fix/change is in here (even our rants)
 Fish (F), Mark (M), DeadNotBuried (D)
 ===============================================================================
 * NeoStats * Version 3.0.a3-dev
+ - Fix a potential security vulnerbility with user supplied strings (F)
+ - NeoStats now compiles and runs on Mac OSX (Tiger) (F)
  - Introduce module override to allow a module bot to become the primary source
    of signon CTCP version requests. (M)
  - Add broadcast forms of CTCP events so that modules can watch just their own 

include/neostats.h

@@ -1221,6 +1221,7 @@ EXPORTFUNC char *sstrdup( const char *s );
 char *strlwr( char *s );
 EXPORTFUNC void AddStringToList( char ***List, char S[], int *C );
 EXPORTFUNC void strip_mirc_codes( char *text );
+EXPORTFUNC void clean_string(char *text, size_t len);
 EXPORTFUNC char *sctime( time_t t );
 EXPORTFUNC char *sftime( time_t t );
 EXPORTFUNC char *make_safe_filename( char *name );

modules/connectserv/cs.c

@@ -289,6 +289,10 @@ static void cs_report( const char *fmt, ... )
 	va_start( ap, fmt );
 	ircvsnprintf( buf, BUFSIZE, fmt, ap );
 	va_end( ap );
+
+	/* make sure the user can't use format specifers to crash/buffer overflow */
+	clean_string(buf, BUFSIZE);
+	
 	irc_chanalert( cs_bot, buf );
 	if( cs_cfg.logging ) 
 		nlog( LOG_NORMAL, buf );

src/misc.c

@@ -363,6 +363,44 @@ void strip_mirc_codes( char *text )
 	*dd = 0;
 }
 
+/** @brief clean_string
+ * 
+ *  cleans up a string, escaping some vars that could be used to
+ *  crash neostats (like format strings, %s %d etc)
+ * 
+ *  @param text to clean
+ *
+ *  @returns none
+ */
+
+void clean_string( char *text, size_t len )
+{
+	char *dd, *start, *orig; 
+	int i = 0;
+	dd = malloc(len);	
+	start = dd;
+	orig = text;
+	
+	while( *text ) {
+		i++;
+		switch( *text ) {
+			case '%':
+				/* if our final length is bigger than the buffer, then we just 
+				 * drop the char */
+				if ( (i+1) <= len) {
+					*dd++ = '%';
+				} else {
+					*text++;
+				}
+				break;
+		}
+		*dd++ = *text++;		/* Move on to the next char */
+	}
+	*dd = 0;
+	strncpy(orig,start,len);
+	free(start);	
+}
+
 /** @brief sctime
  * 
  *