diff options
| author | Johan Hedberg <johan.hedberg@intel.com> | 2011-10-06 14:31:13 +0300 |
|---|---|---|
| committer | Marcel Holtmann <marcel@holtmann.org> | 2012-12-04 22:22:03 +0100 |
| commit | 3a7f9049c0fef124ccb0f3fbbb45dd021301cbbd (patch) | |
| tree | c1ab8354e2fea705f1e362b3b957d087761980f6 /gobex | |
| parent | 1c2da64348f85314e73494a0372cf26bb2cf821c (diff) | |
| download | bluez-3a7f9049c0fef124ccb0f3fbbb45dd021301cbbd.tar.gz | |
gobex: Fix decoding byte array headers with too small length
Length values of less than 3 are invalid.
Diffstat (limited to 'gobex')
| -rw-r--r-- | gobex/gobex-header.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/gobex/gobex-header.c b/gobex/gobex-header.c index 9096f446a..68e23411d 100644 --- a/gobex/gobex-header.c +++ b/gobex/gobex-header.c @@ -208,6 +208,13 @@ GObexHeader *g_obex_header_decode(const void *data, gsize len, goto failed; } + if (hdr_len < 3) { + g_set_error(err, G_OBEX_ERROR, + G_OBEX_ERROR_PARSE_ERROR, + "Too small byte array length"); + goto failed; + } + header->vlen = hdr_len - 3; header->hlen = hdr_len; |