Mercurial > dropbear
changeset 791:0bf76f54de6f
Limit decompressed size
| author | Matt Johnston <matt@ucc.asn.au> |
|---|---|
| date | Wed, 08 May 2013 23:23:14 +0800 |
| parents | 7bd88d546627 |
| children | 239ede24d54f |
| files | packet.c |
| diffstat | 1 files changed, 7 insertions(+), 2 deletions(-) [+] |
line wrap: on
line diff
--- a/packet.c Mon Apr 29 23:42:37 2013 +0800 +++ b/packet.c Wed May 08 23:23:14 2013 +0800 @@ -42,7 +42,7 @@ static int checkmac(); #define ZLIB_COMPRESS_INCR 100 -#define ZLIB_DECOMPRESS_INCR 100 +#define ZLIB_DECOMPRESS_INCR 1024 #ifndef DISABLE_ZLIB static buffer* buf_decompress(buffer* buf, unsigned int len); static void buf_compress(buffer * dest, buffer * src, unsigned int len); @@ -420,7 +420,12 @@ } if (zstream->avail_out == 0) { - buf_resize(ret, ret->size + ZLIB_DECOMPRESS_INCR); + int new_size = 0; + if (ret->size >= RECV_MAX_PAYLOAD_LEN) { + dropbear_exit("bad packet, oversized decompressed"); + } + new_size = MIN(RECV_MAX_PAYLOAD_LEN, ret->size + ZLIB_DECOMPRESS_INCR); + buf_resize(ret, new_size); } } }