StarMirror/toxcore
1
0
Fork 0
mirror of https://github.com/irungentoo/toxcore.git synced 2024-03-22 13:30:51 +08:00
Code Issues Projects Releases Wiki Activity

Fixed possible segfaults from bad input.

Browse Source
This commit is contained in:
irungentoo 2013-09-02 16:35:23 -04:00
parent a4bf25801d
commit 7e8a34bee9
1 changed files with 19 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
toxcore/Lossless_UDP.c
View File

@ -297,6 +297,10 @@ uint32_t sendqueue(Lossless_UDP *ludp, int connection_id)
return 0;
Connection *connection = &tox_array_get(&ludp->connections, connection_id, Connection);
if (connection->status == 0)
return 0;
return connection->sendbuff_packetnum - connection->successful_sent;
}
@ -307,6 +311,10 @@ uint32_t recvqueue(Lossless_UDP *ludp, int connection_id)
return 0;
Connection *connection = &tox_array_get(&ludp->connections, connection_id, Connection);
if (connection->status == 0)
return 0;
return connection->recv_packetnum - connection->successful_read;
}
@ -335,6 +343,10 @@ int read_packet(Lossless_UDP *ludp, int connection_id, uint8_t *data)
return 0;
Connection *connection = &tox_array_get(&ludp->connections, connection_id, Connection);
if (connection->status == 0)
return 0;
uint16_t index = connection->successful_read % MAX_QUEUE_NUM;
uint16_t size = connection->recvbuffer[index].size;
memcpy(data, connection->recvbuffer[index].data, size);
@ -349,10 +361,17 @@ int read_packet(Lossless_UDP *ludp, int connection_id, uint8_t *data)
*/
int write_packet(Lossless_UDP *ludp, int connection_id, uint8_t *data, uint32_t length)
{
if ((unsigned int)connection_id >= ludp->connections.len)
return 0;
if (length > MAX_DATA_SIZE || length == 0 || sendqueue(ludp, connection_id) >= BUFFER_PACKET_NUM)
return 0;
Connection *connection = &tox_array_get(&ludp->connections, connection_id, Connection);
if (connection->status == 0)
return 0;
uint32_t index = connection->sendbuff_packetnum % MAX_QUEUE_NUM;
memcpy(connection->sendbuffer[index].data, data, length);
connection->sendbuffer[index].size = length;