Skip to content
Commit f7fdface authored by Michal Srb's avatar Michal Srb Committed by Derek Foreman
Browse files

connection: Prevent pointer overflow from large lengths.



If the remote side sends sufficiently large `length` field, it will
overflow the `p` pointer. Technically it is undefined behavior, in
practice it makes `p < end`, so the length check passes. Attempts to
access the data later causes crashes.

This issue manifests only on 32bit systems, but the behavior is
undefined everywhere.
Reviewed-by: default avatarPekka Paalanen <pekka.paalanen@collabora.co.uk>
Reviewed-by: default avatarDerek Foreman <derek.foreman.samsung@gmail.com>
parent f5b9e3b9
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment