Commit 2655fffe authored by Samuel Thibault's avatar Samuel Thibault

tcp_emu: Fix oob access

The main loop only checks for one available byte, while we sometimes
need two bytes.
parent 789955c6
......@@ -20,6 +20,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
### Fixed
- ncsi: fix checksum OOB memory access
- `tcp_emu()`: fix OOB accesses
## [4.1.0] - 2019-12-02
......
......@@ -871,6 +871,9 @@ int tcp_emu(struct socket *so, struct mbuf *m)
break;
case 5:
if (bptr == m->m_data + m->m_len - 1)
return 1; /* We need two bytes */
/*
* The difference between versions 1.0 and
* 2.0 is here. For future versions of
......@@ -886,6 +889,10 @@ int tcp_emu(struct socket *so, struct mbuf *m)
/* This is the field containing the port
* number that RA-player is listening to.
*/
if (bptr == m->m_data + m->m_len - 1)
return 1; /* We need two bytes */
lport = (((uint8_t *)bptr)[0] << 8) + ((uint8_t *)bptr)[1];
if (lport < 6970)
lport += 256; /* don't know why */
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment