smw/deskflow
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

#6755 Added a check to prevent buffer overflow

Browse source
This commit is contained in:
Jamie Newbon 2020-08-26 11:40:46 +01:00
parent 3ac4896b53
commit 0a5fbe6e3e
1 changed files with 37 additions and 29 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
src/lib/synergy/ProtocolUtil.cpp
View file

@ -112,11 +112,13 @@ ProtocolUtil::vreadf(synergy::IStream* stream, const char* fmt, va_list args)
switch (*fmt) { switch (*fmt) {
case 'i': { case 'i': {
// check for valid length // check for valid length
assert(len == 1 || len == 2 || len == 4); if (len == 4 || len == 2 || len == 1) {
static const int buffer_size = 4;
// read the data // read the data
UInt8 buffer[4]; UInt8 buffer[buffer_size];
read(stream, buffer, len); //Read the buffer till the len or buffers_size, which ever is smaller
read(stream, buffer, len > buffer_size ? buffer_size : len);
// convert it // convert it
void* v = va_arg(args, void*); void* v = va_arg(args, void*);
@ -146,6 +148,12 @@ ProtocolUtil::vreadf(synergy::IStream* stream, const char* fmt, va_list args)
LOG((CLOG_DEBUG2 "readf: read %d byte integer: %d (0x%x)", len, *static_cast<UInt32*>(v), *static_cast<UInt32*>(v))); LOG((CLOG_DEBUG2 "readf: read %d byte integer: %d (0x%x)", len, *static_cast<UInt32*>(v), *static_cast<UInt32*>(v)));
break; break;
} }
}
else {
//the length is wrong
LOG((CLOG_ERR "read: length to be read is wrong: '%d' should be 1,2, or 4", len));
assert(false); //assert for debugging
}
break; break;
} }