mirror/freebsd
1
0
Fork 0
mirror of https://git.FreeBSD.org/src.git synced 2024-12-01 08:27:59 +00:00
Code Issues Releases Activity

Check that the length of the received message is at least as big as a PDU

Browse Source 
before we use pdu->len.

Submitted by:	Iain Hibbert
MFC after:	3 days
This commit is contained in:
Maksim Yevmenkin 2007-02-23 19:37:47 +00:00
parent 21ab16bd5b
commit 6bfc799ccf
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=166915
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
usr.sbin/bluetooth/sdpd/server.c
View File

@ -432,7 +432,8 @@ server_process_request(server_p srv, int32_t fd)
return (-1);
}
if (sizeof(*pdu) + (pdu->len = ntohs(pdu->len)) == len) {
if (len >= sizeof(*pdu) &&
sizeof(*pdu) + (pdu->len = ntohs(pdu->len)) == len) {
switch (pdu->pid) {
case SDP_PDU_SERVICE_SEARCH_REQUEST:
error = server_prepare_service_search_response(srv, fd);