diff options
| author | Nick Mathewson <nickm@torproject.org> | 2014-03-18 12:27:14 -0400 |
|---|---|---|
| committer | Nick Mathewson <nickm@torproject.org> | 2014-03-18 12:27:14 -0400 |
| commit | 31c491504e12f2d2b65a6cb8850858532b38552b (patch) | |
| tree | 1fe7b86feb2279a3124f9ac08a4e262bd830611f /event_tagging.c | |
| parent | e660db6d5f186bb7f5f99ede9e8016e3f958b002 (diff) | |
| download | libevent-31c491504e12f2d2b65a6cb8850858532b38552b.tar.gz | |
evtag: detect tags over 32-bits earlier
Diffstat (limited to 'event_tagging.c')
| -rw-r--r-- | event_tagging.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/event_tagging.c b/event_tagging.c index 7edd3da5..aef33783 100644 --- a/event_tagging.c +++ b/event_tagging.c @@ -210,7 +210,14 @@ decode_tag_internal(ev_uint32_t *ptag, struct evbuffer *evbuf, int dodrain) while (count++ < len) { ev_uint8_t lower = *data++; - number |= (lower & 0x7f) << shift; + if (shift >= 28) { + /* Make sure it fits into 32 bits */ + if (shift > 28) + return (-1); + if ((lower & 0x7f) > 15) + return (-1); + } + number |= (lower & (unsigned)0x7f) << shift; shift += 7; if (!(lower & 0x80)) { |