Subj : src/sbbs3/chat.cpp useredit.cpp
To   : Git commit to main/sbbs/master
From : Rob Swindell (on Debian Linux)
Date : Tue Aug 11 2026 21:39:59

https://gitlab.synchro.net/main/sbbs/-/commit/a921e071e97e64135b6d628a
Modified Files:
	src/sbbs3/chat.cpp useredit.cpp
Log Message:
uedit/chat: don't mistake a ctrl-c for a number entry (CID 652885)

getkeys() returns -1 on ctrl-c, abort, or disconnect, and value|0x80000000
for a typed number. Both callers tested only "x & 0x80000000L". On LP64 that
literal is a 64-bit long, so an int -1 sign-extends and the test is true: the
abort is read as a number.

In useredit() that set user.number to 2147483647 and looped instead of
leaving the editor. The (ushort) cast dropped in 62f96a750b (hawk-27-disc,
2026-08-09) had been narrowing the result to 65535, which is why the defect
only became visible to the analyzer now.

In multinodechat() the / command left savch == -1 and called chan_access(-2),
reading cfg.chan[] out of bounds; chan_access() bounded cnum from above only,
so it now rejects a negative channel too.

Guard both call sites the way readmsgs.cpp and readmail.cpp already do.
scansubs.cpp shares the idiom but checks s == -1 after every getkeys().

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
--- SBBSecho 3.37-Linux
 * Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

.