Archives/i2pd
2
0
Fork 0
mirror of https://github.com/PurpleI2P/i2pd.git synced 2024-11-04 06:00:37 +00:00
Code Issues Projects Releases Wiki Activity

check and limit LeaseSet's buffer size

Browse Source
This commit is contained in:
orignal 2022-11-22 15:40:48 -05:00
parent ba3cee1cf1
commit 9e02c99db5
2 changed files with 23 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
libi2pd/LeaseSet.cpp
View File

@ -37,14 +37,7 @@ namespace data
void LeaseSet::Update (const uint8_t * buf, size_t len, bool verifySignature) void LeaseSet::Update (const uint8_t * buf, size_t len, bool verifySignature)
{ {
if (len > m_BufferLen) SetBuffer (buf, len);
{
auto oldBuffer = m_Buffer;
m_Buffer = new uint8_t[len];
delete[] oldBuffer;
}
memcpy (m_Buffer, buf, len);
m_BufferLen = len;
ReadFromBuffer (false, verifySignature); ReadFromBuffer (false, verifySignature);
} }
@ -264,7 +257,17 @@ namespace data
void LeaseSet::SetBuffer (const uint8_t * buf, size_t len) void LeaseSet::SetBuffer (const uint8_t * buf, size_t len)
{ {
if (m_Buffer) delete[] m_Buffer; if (len > MAX_LS_BUFFER_SIZE)
{
LogPrint (eLogError, "LeaseSet: Buffer is too long ", len);
len = MAX_LS_BUFFER_SIZE;
}
if (m_Buffer && len > m_BufferLen)
{
delete[] m_Buffer;
m_Buffer = nullptr;
}
if (!m_Buffer)
m_Buffer = new uint8_t[len]; m_Buffer = new uint8_t[len];
m_BufferLen = len; m_BufferLen = len;
memcpy (m_Buffer, buf, len); memcpy (m_Buffer, buf, len);

10
libi2pd/NetDb.cpp
View File

@ -749,6 +749,11 @@ namespace data
{ {
const uint8_t * buf = m->GetPayload (); const uint8_t * buf = m->GetPayload ();
size_t len = m->GetSize (); size_t len = m->GetSize ();
if (len < DATABASE_STORE_HEADER_SIZE)
{
LogPrint (eLogError, "NetDb: Database store msg is too short ", len, ". Dropped");
return;
}
IdentHash ident (buf + DATABASE_STORE_KEY_OFFSET); IdentHash ident (buf + DATABASE_STORE_KEY_OFFSET);
if (ident.IsZero ()) if (ident.IsZero ())
{ {
@ -759,6 +764,11 @@ namespace data
size_t offset = DATABASE_STORE_HEADER_SIZE; size_t offset = DATABASE_STORE_HEADER_SIZE;
if (replyToken) if (replyToken)
{ {
if (len < offset + 36) // 32 + 4
{
LogPrint (eLogError, "NetDb: Database store msg with reply token is too short ", len, ". Dropped");
return;
}
auto deliveryStatus = CreateDeliveryStatusMsg (replyToken); auto deliveryStatus = CreateDeliveryStatusMsg (replyToken);
uint32_t tunnelID = bufbe32toh (buf + offset); uint32_t tunnelID = bufbe32toh (buf + offset);
offset += 4; offset += 4;