Mercurial > dropbear
changeset 1305:6914eedb1072
additional length checks
| author | Matt Johnston <matt@ucc.asn.au> |
|---|---|
| date | Mon, 11 Jul 2016 23:34:18 +0800 |
| parents | b66a483f3dcb |
| children | 34e6127ef02e |
| files | buffer.c |
| diffstat | 1 files changed, 6 insertions(+), 5 deletions(-) [+] |
line wrap: on
line diff
--- a/buffer.c Mon Jul 11 23:09:33 2016 +0800 +++ b/buffer.c Mon Jul 11 23:34:18 2016 +0800 @@ -141,9 +141,10 @@ /* increment the position by incr, negative values are allowed, to * decrement the pos*/ void buf_incrpos(buffer* buf, int incr) { - if (incr > BUF_MAX_INCR || - (unsigned int)((int)buf->pos + incr) > buf->len - || ((int)buf->pos + incr) < 0) { + if (incr > BUF_MAX_INCR + || incr < -BUF_MAX_INCR + || (unsigned int)((int)buf->pos + incr) > buf->len + || ((int)buf->pos + incr) < 0) { dropbear_exit("Bad buf_incrpos"); } buf->pos += incr; @@ -184,7 +185,7 @@ * the next len bytes from that position can be used */ unsigned char* buf_getptr(buffer* buf, unsigned int len) { - if (buf->pos + len > buf->len) { + if (len > BUF_MAX_INCR || buf->pos + len > buf->len) { dropbear_exit("Bad buf_getptr"); } return &buf->data[buf->pos]; @@ -194,7 +195,7 @@ * This allows writing past the used length, but not past the size */ unsigned char* buf_getwriteptr(buffer* buf, unsigned int len) { - if (buf->pos + len > buf->size) { + if (len > BUF_MAX_INCR || buf->pos + len > buf->size) { dropbear_exit("Bad buf_getwriteptr"); } return &buf->data[buf->pos];