diff options
| author | Marc-André Lureau <marcandre.lureau@redhat.com> | 2019-05-03 13:32:04 +0200 |
|---|---|---|
| committer | Marc-André Lureau <marcandre.lureau@redhat.com> | 2019-05-03 13:32:12 +0200 |
| commit | 306fef58b54d793ba4b259728c21322765bda917 (patch) | |
| tree | dad34cd90fb5636973a3b371353f0eb203acd6d7 /src/tcp_subr.c | |
| parent | 59a1b1f165458c2acb7ff0525b543945f7416225 (diff) | |
| download | slirp-306fef58b54d793ba4b259728c21322765bda917.zip slirp-306fef58b54d793ba4b259728c21322765bda917.tar.gz slirp-306fef58b54d793ba4b259728c21322765bda917.tar.bz2 | |
slirp: ensure there is enough space in mbuf to null-terminate
Prevents from buffer overflows.
Related to: https://bugzilla.redhat.com/show_bug.cgi?id=1664205
Cc: Prasad J Pandit <pjp@fedoraproject.org>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Diffstat (limited to 'src/tcp_subr.c')
| -rw-r--r-- | src/tcp_subr.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/src/tcp_subr.c b/src/tcp_subr.c index 7ab3ab2..aa10bc8 100644 --- a/src/tcp_subr.c +++ b/src/tcp_subr.c @@ -639,6 +639,7 @@ int tcp_emu(struct socket *so, struct mbuf *m) memcpy(so_rcv->sb_wptr, m->m_data, m->m_len); so_rcv->sb_wptr += m->m_len; so_rcv->sb_rptr += m->m_len; + m_inc(m, m->m_len + 1); m->m_data[m->m_len] = 0; /* NULL terminate */ if (strchr(m->m_data, '\r') || strchr(m->m_data, '\n')) { if (sscanf(so_rcv->sb_data, "%u%*[ ,]%u", &n1, &n2) == 2) { @@ -671,6 +672,7 @@ int tcp_emu(struct socket *so, struct mbuf *m) } case EMU_FTP: /* ftp */ + m_inc(m, m->m_len + 1); *(m->m_data + m->m_len) = 0; /* NUL terminate for strstr */ if ((bptr = (char *)strstr(m->m_data, "ORT")) != NULL) { /* @@ -771,6 +773,7 @@ int tcp_emu(struct socket *so, struct mbuf *m) /* * Need to emulate DCC CHAT, DCC SEND and DCC MOVE */ + m_inc(m, m->m_len + 1); *(m->m_data + m->m_len) = 0; /* NULL terminate the string for strstr */ if ((bptr = (char *)strstr(m->m_data, "DCC")) == NULL) return 1; |