All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH 1/3] add some length verification to avoid reading not owned memory
@ 2012-02-28  8:17 jr_extern
  2012-02-28  8:17 ` [PATCH 2/3] changing depreciated libtool initialization to modern one jr_extern
                   ` (2 more replies)
  0 siblings, 3 replies; 7+ messages in thread
From: jr_extern @ 2012-02-28  8:17 UTC (permalink / raw)
  To: ofono

[-- Attachment #1: Type: text/plain, Size: 1200 bytes --]

From: Jens Rehsack <jr_extern@vfnet.de>

---
 src/push.c |    8 +++++++-
 1 files changed, 7 insertions(+), 1 deletions(-)

diff --git a/src/push.c b/src/push.c
index 6a54907..6107352 100644
--- a/src/push.c
+++ b/src/push.c
@@ -351,13 +351,16 @@ gboolean mms_push_notify(unsigned char *pdu, unsigned int len,
 	/* Consume TID and Type */
 	nread = 2;
 
-	if (wsp_decode_uintvar(pdu + nread, len,
+	if (wsp_decode_uintvar(pdu + nread, len - nread,
 					&headerslen, &consumed) == FALSE)
 		return FALSE;
 
 	/* Consume uintvar bytes */
 	nread += consumed;
 
+	/* Check if content type could be read */
+	if (headerslen > (len - nread))
+		return FALSE;
 	/* Try to decode content-type */
 	if (wsp_decode_content_type(pdu + nread, headerslen, &ct,
 			&consumed, &param_len) == FALSE)
@@ -370,6 +373,9 @@ gboolean mms_push_notify(unsigned char *pdu, unsigned int len,
 	consumed += param_len;
 	nread += consumed;
 
+	/* Check if application_id could be read */
+	if ((headerslen - consumed) > (len - nread))
+		return FALSE;
 	/* Parse header to decode application_id */
 	wsp_header_iter_init(&iter, pdu + nread, headerslen - consumed, 0);
 
-- 
1.7.9.1


^ permalink raw reply related	[flat|nested] 7+ messages in thread

end of thread, other threads:[~2012-03-23 19:11 UTC | newest]

Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2012-02-28  8:17 [PATCH 1/3] add some length verification to avoid reading not owned memory jr_extern
2012-02-28  8:17 ` [PATCH 2/3] changing depreciated libtool initialization to modern one jr_extern
2012-02-28 16:15   ` Jens Rehsack
2012-03-23 19:09     ` Marcel Holtmann
2012-02-28  8:17 ` [PATCH 3/3] let configure find required libs jr_extern
2012-03-23 19:11   ` Marcel Holtmann
2012-03-23 19:09 ` [PATCH 1/3] add some length verification to avoid reading not owned memory Marcel Holtmann

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.