StarMirror/toxcore
1
0
Fork 0
mirror of https://github.com/irungentoo/toxcore.git synced 2024-03-22 13:30:51 +08:00
Code Issues Projects Releases Wiki Activity

refactor: Protect array unpacking against invalid lengths.

Browse Source 
Each array element is at least 1 byte, so if there are fewer bytes than
array elements, the array size is invalid.
This commit is contained in:
iphydf 2022-04-05 10:41:51 +00:00
parent c4beda4dd1
commit 2fb25b9328
No known key found for this signature in database
GPG Key ID: 3855DBA2D74403C9
3 changed files with 11 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
other/bootstrap_daemon/docker/tox-bootstrapd.sha256
View File

@ -1 +1 @@
146fb36bf3100115f913a07583c096c8dc98ab26e1220567e465b2ca86a69583 /usr/local/bin/tox-bootstrapd
95ae45707c9a19ea9c8c0a537c5defb228f8d7eca1c51c0225a3bc07a50891c6 /usr/local/bin/tox-bootstrapd

9
toxcore/bin_pack_test.cc
View File

@ -122,4 +122,13 @@ TEST(BinPack, BinCanHoldArbitraryData)
EXPECT_EQ(str, (std::array<uint8_t, 5>{'h', 'e', 'l', 'l', 'o'}));
}
TEST(BinPack, OversizedArrayFailsUnpack)
{
std::array<uint8_t, 1> buf = {0x91};
Bin_Unpack_Ptr bu(bin_unpack_new(buf.data(), buf.size()));
uint32_t size;
EXPECT_FALSE(bin_unpack_array(bu.get(), &size));
}
} // namespace

2
toxcore/bin_unpack.c
View File

@ -70,7 +70,7 @@ void bin_unpack_free(Bin_Unpack *bu)
bool bin_unpack_array(Bin_Unpack *bu, uint32_t *size)
{
return cmp_read_array(&bu->ctx, size);
return cmp_read_array(&bu->ctx, size) && *size <= bu->bytes_size;
}
bool bin_unpack_array_fixed(Bin_Unpack *bu, uint32_t required_size)