Mirrors/i2pd
2
0
Fork 0
mirror of https://github.com/PurpleI2P/i2pd.git synced 2025-04-24 01:46:36 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 6

Added bounds checking.

Browse source
This commit is contained in:
Chad Fraleigh 2023-07-03 15:49:18 -07:00
parent 245e6b6efd
commit a516d7812a
No known key found for this signature in database
GPG key ID: 2415C39758458A8F
2 changed files with 12 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
libi2pd/LeaseSet.cpp
View file

@ -394,6 +394,10 @@ namespace data
size_t LeaseSet2::ReadStandardLS2TypeSpecificPart (const uint8_t * buf, size_t len) size_t LeaseSet2::ReadStandardLS2TypeSpecificPart (const uint8_t * buf, size_t len)
{ {
size_t offset = 0; size_t offset = 0;
if(offset + 2 > len) // AKA (len < 2)
return 0;
// properties // properties
uint16_t propertiesLen = bufbe16toh (buf + offset); offset += 2; uint16_t propertiesLen = bufbe16toh (buf + offset); offset += 2;
offset += propertiesLen; // skip for now. TODO: implement properties offset += propertiesLen; // skip for now. TODO: implement properties
@ -448,6 +452,10 @@ namespace data
size_t LeaseSet2::ReadMetaLS2TypeSpecificPart (const uint8_t * buf, size_t len) size_t LeaseSet2::ReadMetaLS2TypeSpecificPart (const uint8_t * buf, size_t len)
{ {
size_t offset = 0; size_t offset = 0;
if(offset + 2 > len) // AKA (len < 2)
return 0;
// properties // properties
uint16_t propertiesLen = bufbe16toh (buf + offset); offset += 2; uint16_t propertiesLen = bufbe16toh (buf + offset); offset += 2;
offset += propertiesLen; // skip for now. TODO: implement properties offset += propertiesLen; // skip for now. TODO: implement properties

4
libi2pd/NetDb.cpp
View file

@ -922,6 +922,10 @@ namespace data
else if(!m_FloodfillBootstrap) else if(!m_FloodfillBootstrap)
LogPrint (eLogWarning, "NetDb: Requested destination for ", key, " not found"); LogPrint (eLogWarning, "NetDb: Requested destination for ", key, " not found");
// All peers hashs in buffer?
if(msg->GetPayloadLength() < (size_t) (33 + num * 32))
return;
// try responses // try responses
for (int i = 0; i < num; i++) for (int i = 0; i < num; i++)
{ {