mirror of
https://github.com/clearml/dropbear
synced 2025-06-26 18:17:32 +00:00
Limit decompressed size
This commit is contained in:
parent
57166b400c
commit
49263b5314
9
packet.c
9
packet.c
@ -42,7 +42,7 @@ static void make_mac(unsigned int seqno, const struct key_context_directional *
|
|||||||
static int checkmac();
|
static int checkmac();
|
||||||
|
|
||||||
#define ZLIB_COMPRESS_INCR 100
|
#define ZLIB_COMPRESS_INCR 100
|
||||||
#define ZLIB_DECOMPRESS_INCR 100
|
#define ZLIB_DECOMPRESS_INCR 1024
|
||||||
#ifndef DISABLE_ZLIB
|
#ifndef DISABLE_ZLIB
|
||||||
static buffer* buf_decompress(buffer* buf, unsigned int len);
|
static buffer* buf_decompress(buffer* buf, unsigned int len);
|
||||||
static void buf_compress(buffer * dest, buffer * src, unsigned int len);
|
static void buf_compress(buffer * dest, buffer * src, unsigned int len);
|
||||||
@ -420,7 +420,12 @@ static buffer* buf_decompress(buffer* buf, unsigned int len) {
|
|||||||
}
|
}
|
||||||
|
|
||||||
if (zstream->avail_out == 0) {
|
if (zstream->avail_out == 0) {
|
||||||
buf_resize(ret, ret->size + ZLIB_DECOMPRESS_INCR);
|
int new_size = 0;
|
||||||
|
if (ret->size >= RECV_MAX_PAYLOAD_LEN) {
|
||||||
|
dropbear_exit("bad packet, oversized decompressed");
|
||||||
|
}
|
||||||
|
new_size = MIN(RECV_MAX_PAYLOAD_LEN, ret->size + ZLIB_DECOMPRESS_INCR);
|
||||||
|
buf_resize(ret, new_size);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
Loading…
Reference in New Issue
Block a user