diff options
Diffstat (limited to 'sntp/libevent/event_tagging.c')
| -rw-r--r-- | sntp/libevent/event_tagging.c | 15 |
1 files changed, 14 insertions, 1 deletions
diff --git a/sntp/libevent/event_tagging.c b/sntp/libevent/event_tagging.c index 7edd3da..64b100b 100644 --- a/sntp/libevent/event_tagging.c +++ b/sntp/libevent/event_tagging.c @@ -207,10 +207,19 @@ decode_tag_internal(ev_uint32_t *ptag, struct evbuffer *evbuf, int dodrain) */ data = evbuffer_pullup( evbuf, len < sizeof(number) + 1 ? len : sizeof(number) + 1); + if (!data) + return (-1); while (count++ < len) { ev_uint8_t lower = *data++; - number |= (lower & 0x7f) << shift; + if (shift >= 28) { + /* Make sure it fits into 32 bits */ + if (shift > 28) + return (-1); + if ((lower & 0x7f) > 15) + return (-1); + } + number |= (lower & (unsigned)0x7f) << shift; shift += 7; if (!(lower & 0x80)) { @@ -313,6 +322,8 @@ do { \ \ /* XXX(niels): faster? */ \ data = evbuffer_pullup(evbuf, offset + 1) + offset; \ + if (!data) \ + return (-1); \ \ nibbles = ((data[0] & 0xf0) >> 4) + 1; \ if (nibbles > maxnibbles || (nibbles >> 1) + 1 > len) \ @@ -320,6 +331,8 @@ do { \ len = (nibbles >> 1) + 1; \ \ data = evbuffer_pullup(evbuf, offset + len) + offset; \ + if (!data) \ + return (-1); \ \ while (nibbles > 0) { \ number <<= 4; \ |