Bladeren bron

core: pass fd - check for unexpected read size overflow

(cherry picked from commit 6c12477f1dad2279431d703d1a4f63fcfc6543b8)
(cherry picked from commit ac0a4a5052e9aaf6531130675c8140fdd5c11e97)
(cherry picked from commit 42260f34079ddad7662742a64696d2550ee1cce9)
Daniel-Constantin Mierla 7 maanden geleden
bovenliggende
commit
3c3c710798
1 gewijzigde bestanden met toevoegingen van 8 en 2 verwijderingen
  1. 8 2
      src/core/pass_fd.c

+ 8 - 2
src/core/pass_fd.c

@@ -33,6 +33,7 @@
 #include <sys/socket.h>
 #include <sys/uio.h>
 #include <stdlib.h> /* for NULL definition on openbsd */
+#include <limits.h>
 #include <errno.h>
 #include <string.h>
 #ifdef NO_MSG_WAITALL
@@ -287,9 +288,14 @@ again:
 		/* blocking recv_all */
 		n = recv_all(
 				unix_socket, (char *)data + ret, data_len - ret, MSG_WAITALL);
-		if(n >= 0)
+		if(n >= 0) {
+			if(ret >= INT_MAX - n) {
+				LM_ERR("int size overflowing: %d + %d\n", ret, n);
+				ret = -1;
+				goto error;
+			}
 			ret += n;
-		else {
+		} else {
 			ret = n;
 			goto error;
 		}