In hast_proto_recv_data() check that the size of the data to be
received does not exceed the buffer size. Approved by: pjd (mentor) MFC after: 1 week
This commit is contained in:
parent
47f1eb5c4b
commit
1d521b1cbd
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=220522
@ -189,9 +189,12 @@ hast_proto_recv_data(const struct hast_resource *res, struct proto_conn *conn,
|
|||||||
dptr = data;
|
dptr = data;
|
||||||
|
|
||||||
dsize = nv_get_uint32(nv, "size");
|
dsize = nv_get_uint32(nv, "size");
|
||||||
if (dsize == 0)
|
if (dsize > size) {
|
||||||
|
errno = EINVAL;
|
||||||
|
goto end;
|
||||||
|
} else if (dsize == 0) {
|
||||||
(void)nv_set_error(nv, 0);
|
(void)nv_set_error(nv, 0);
|
||||||
else {
|
} else {
|
||||||
if (proto_recv(conn, data, dsize) < 0)
|
if (proto_recv(conn, data, dsize) < 0)
|
||||||
goto end;
|
goto end;
|
||||||
for (ii = sizeof(pipeline) / sizeof(pipeline[0]); ii > 0;
|
for (ii = sizeof(pipeline) / sizeof(pipeline[0]); ii > 0;
|
||||||
|
Loading…
Reference in New Issue
Block a user