mirrors/xrdp
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add lower bound to sesman data input size check

Browse Source
This commit is contained in:
matt335672 2022-02-02 10:39:50 +00:00
parent 934a91fc29
commit eb4a8e342d
1 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
sesman/sesman.c
View File

@ -276,6 +276,7 @@ sesman_close_all(void)
static int
sesman_data_in(struct trans *self)
{
#define HEADER_SIZE 8
int version;
int size;
@ -283,9 +284,9 @@ sesman_data_in(struct trans *self)
{
in_uint32_be(self->in_s, version);
in_uint32_be(self->in_s, size);
if (size > self->in_s->size)
if (size < HEADER_SIZE || size > self->in_s->size)
{
LOG(LOG_LEVEL_ERROR, "sesman_data_in: bad message size");
LOG(LOG_LEVEL_ERROR, "sesman_data_in: bad message size %d", size);
return 1;
}
self->header_size = size;
@ -302,11 +303,12 @@ sesman_data_in(struct trans *self)
return 1;
}
/* reset for next message */
self->header_size = 8;
self->header_size = HEADER_SIZE;
self->extra_flags = 0;
init_stream(self->in_s, 0); /* Reset input stream pointers */
}
return 0;
#undef HEADER_SIZE
}
/******************************************************************************/