d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

In hast_proto_recv_data() check that the size of the data to be

Browse Source 
received does not exceed the buffer size.

Approved by:	pjd (mentor)
MFC after:	1 week
This commit is contained in:
trociny 2011-04-10 15:21:46 +00:00
parent 4ff6b11c08
commit cbdb24d2fb
1 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
sbin/hastd/hast_proto.c
View File

@ -189,9 +189,12 @@ hast_proto_recv_data(const struct hast_resource *res, struct proto_conn *conn,
dptr = data;
dsize = nv_get_uint32(nv, "size");
if (dsize == 0)
if (dsize > size) {
errno = EINVAL;
goto end;
} else if (dsize == 0) {
(void)nv_set_error(nv, 0);
else {
} else {
if (proto_recv(conn, data, dsize) < 0)
goto end;
for (ii = sizeof(pipeline) / sizeof(pipeline[0]); ii > 0;