StarMirror/toxcore
1
0
Fork 0
mirror of https://github.com/irungentoo/toxcore.git synced 2024-03-22 13:30:51 +08:00
Code Issues Projects Releases Wiki Activity

fix missing group title length check

Browse Source 
This fixes a buffer overflow when a malformed *.tox save file is
loaded.
This commit is contained in:
sudden6 2019-08-03 14:55:41 +02:00
parent 7418174129
commit 8ed83c3d4c
No known key found for this signature in database
GPG Key ID: 279509B499E032B9
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
toxcore/group.c
View File

@ -3294,6 +3294,11 @@ static State_Load_Status load_conferences(Group_Chats *g_c, const uint8_t *data,
}
g->title_len = *data;
if (g->title_len > MAX_NAME_LENGTH) {
return STATE_LOAD_STATUS_ERROR;
}
++data;
if (length < (uint32_t)(data - init_data) + g->title_len) {