smw/deskflow
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

#6755 Added a check to prevent buffer overflow

Browse source
This commit is contained in:
Jamie Newbon 2020-08-26 11:40:46 +01:00
parent 3ac4896b53
commit 0a5fbe6e3e
1 changed files with 37 additions and 29 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

66
src/lib/synergy/ProtocolUtil.cpp
View file

@ -112,39 +112,47 @@ ProtocolUtil::vreadf(synergy::IStream* stream, const char* fmt, va_list args)
switch (*fmt) { switch (*fmt) {
case 'i': { case 'i': {
// check for valid length // check for valid length
assert(len == 1 || len == 2 || len == 4); if (len == 4 || len == 2 || len == 1) {
// read the data static const int buffer_size = 4;
UInt8 buffer[4]; // read the data
read(stream, buffer, len); UInt8 buffer[buffer_size];
//Read the buffer till the len or buffers_size, which ever is smaller
read(stream, buffer, len > buffer_size ? buffer_size : len);
// convert it // convert it
void* v = va_arg(args, void*); void* v = va_arg(args, void*);
switch (len) { switch (len) {
case 1: case 1:
// 1 byte integer // 1 byte integer
*static_cast<UInt8*>(v) = buffer[0]; *static_cast<UInt8*>(v) = buffer[0];
LOG((CLOG_DEBUG2 "readf: read %d byte integer: %d (0x%x)", len, *static_cast<UInt8*>(v), *static_cast<UInt8*>(v))); LOG((CLOG_DEBUG2 "readf: read %d byte integer: %d (0x%x)", len, *static_cast<UInt8*>(v), *static_cast<UInt8*>(v)));
break; break;
case 2: case 2:
// 2 byte integer // 2 byte integer
*static_cast<UInt16*>(v) = *static_cast<UInt16*>(v) =
static_cast<UInt16>( static_cast<UInt16>(
(static_cast<UInt16>(buffer[0]) << 8) | (static_cast<UInt16>(buffer[0]) << 8) |
static_cast<UInt16>(buffer[1])); static_cast<UInt16>(buffer[1]));
LOG((CLOG_DEBUG2 "readf: read %d byte integer: %d (0x%x)", len, *static_cast<UInt16*>(v), *static_cast<UInt16*>(v))); LOG((CLOG_DEBUG2 "readf: read %d byte integer: %d (0x%x)", len, *static_cast<UInt16*>(v), *static_cast<UInt16*>(v)));
break; break;
case 4: case 4:
// 4 byte integer // 4 byte integer
*static_cast<UInt32*>(v) = *static_cast<UInt32*>(v) =
(static_cast<UInt32>(buffer[0]) << 24) | (static_cast<UInt32>(buffer[0]) << 24) |
(static_cast<UInt32>(buffer[1]) << 16) | (static_cast<UInt32>(buffer[1]) << 16) |
(static_cast<UInt32>(buffer[2]) << 8) | (static_cast<UInt32>(buffer[2]) << 8) |
static_cast<UInt32>(buffer[3]); static_cast<UInt32>(buffer[3]);
LOG((CLOG_DEBUG2 "readf: read %d byte integer: %d (0x%x)", len, *static_cast<UInt32*>(v), *static_cast<UInt32*>(v))); LOG((CLOG_DEBUG2 "readf: read %d byte integer: %d (0x%x)", len, *static_cast<UInt32*>(v), *static_cast<UInt32*>(v)));
break; break;
}
}
else {
//the length is wrong
LOG((CLOG_ERR "read: length to be read is wrong: '%d' should be 1,2, or 4", len));
assert(false); //assert for debugging
} }
break; break;
} }