diff options
| author | Paul Mackerras <paulus@samba.org> | 1996-05-24 07:04:55 +0000 |
|---|---|---|
| committer | Paul Mackerras <paulus@samba.org> | 1996-05-24 07:04:55 +0000 |
| commit | 31e80dd05aec83cbee14a9ede031023188e31270 (patch) | |
| tree | 9ebfa3a2b1d99fa74a68bfa7d70508910cf9ec6e /NeXT/vjcompress.c | |
| parent | 75b939e20d5e27fa7e0113fe782d6c2f6a521602 (diff) | |
| download | ppp-31e80dd05aec83cbee14a9ede031023188e31270.tar.gz | |
check that VJ-unc header doesn't overflow buffer
Diffstat (limited to 'NeXT/vjcompress.c')
| -rw-r--r-- | NeXT/vjcompress.c | 12 |
1 files changed, 7 insertions, 5 deletions
diff --git a/NeXT/vjcompress.c b/NeXT/vjcompress.c index 237b1ff..0a0a29a 100644 --- a/NeXT/vjcompress.c +++ b/NeXT/vjcompress.c @@ -29,7 +29,7 @@ * This version is used under SunOS 4.x, DEC Alpha OSF/1, AIX 4.x, * and SVR4 systems including Solaris 2. * - * $Id: vjcompress.c,v 1.1 1995/12/18 03:30:20 paulus Exp $ + * $Id: vjcompress.c,v 1.2 1996/05/24 07:04:06 paulus Exp $ */ #include <sys/types.h> @@ -439,7 +439,12 @@ vj_uncompress_uncomp(buf, comp) register struct ip *ip; ip = (struct ip *) buf; - if (ip->ip_p >= MAX_STATES) { + hlen = getip_hl(*ip) << 2; + if (ip->ip_p >= MAX_STATES + || hlen + sizeof(struct tcphdr) > buflen + || (hlen += getth_off(*((struct tcphdr *)&((char *)ip)[hlen])) << 2) + > buflen + || hlen > MAX_HDR) { comp->flags |= VJF_TOSS; INCR(vjs_errorin); return (0); @@ -447,9 +452,6 @@ vj_uncompress_uncomp(buf, comp) cs = &comp->rstate[comp->last_recv = ip->ip_p]; comp->flags &=~ VJF_TOSS; ip->ip_p = IPPROTO_TCP; - hlen = getip_hl(*ip); - hlen += getth_off(*((struct tcphdr *)&((int *)ip)[hlen])); - hlen <<= 2; BCOPY(ip, &cs->cs_ip, hlen); cs->cs_hlen = hlen; INCR(vjs_uncompressedin); |