ClearML/dropbear
1
0
Fork 0
mirror of https://github.com/clearml/dropbear synced 2025-06-26 18:17:32 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Limit decompressed size

Browse Source
This commit is contained in:
Matt Johnston 2013-05-08 23:23:14 +08:00
parent 57166b400c
commit 49263b5314
1 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
packet.c
View File

@ -42,7 +42,7 @@ static void make_mac(unsigned int seqno, const struct key_context_directional *
static int checkmac(); static int checkmac();
#define ZLIB_COMPRESS_INCR 100 #define ZLIB_COMPRESS_INCR 100
#define ZLIB_DECOMPRESS_INCR 100 #define ZLIB_DECOMPRESS_INCR 1024
#ifndef DISABLE_ZLIB #ifndef DISABLE_ZLIB
static buffer* buf_decompress(buffer* buf, unsigned int len); static buffer* buf_decompress(buffer* buf, unsigned int len);
static void buf_compress(buffer * dest, buffer * src, unsigned int len); static void buf_compress(buffer * dest, buffer * src, unsigned int len);
@ -420,7 +420,12 @@ static buffer* buf_decompress(buffer* buf, unsigned int len) {
} }
if (zstream->avail_out == 0) { if (zstream->avail_out == 0) {
buf_resize(ret, ret->size + ZLIB_DECOMPRESS_INCR); int new_size = 0;
if (ret->size >= RECV_MAX_PAYLOAD_LEN) {
dropbear_exit("bad packet, oversized decompressed");
}
new_size = MIN(RECV_MAX_PAYLOAD_LEN, ret->size + ZLIB_DECOMPRESS_INCR);
buf_resize(ret, new_size);
} }
} }
} }