anonfunc/xtables-addons
1
0
Fork 0
mirror of git://git.code.sf.net/p/xtables-addons/xtables-addons synced 2025-09-08 21:54:57 +02:00
Code Issues Releases Wiki Activity

ipp2p: ensure better array bounds checking

Browse Source
This commit is contained in:
Jan Engelhardt
2008-12-10 16:28:23 +01:00
parent ee968691d7
commit d01a5f3d17
1 changed files with 24 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
extensions/xt_ipp2p.c
View File

@@ -597,30 +597,41 @@ search_all_gnu(const unsigned char *payload, const unsigned int plen)
} }
/* check for KaZaA download commands and other typical data */ /* check for KaZaA download commands and other typical data */
/* plen is guaranteed to be >= 5 (see @matchlist) */
static unsigned int static unsigned int
search_all_kazaa(const unsigned char *payload, const unsigned int plen) search_all_kazaa(const unsigned char *payload, const unsigned int plen)
{ {
uint16_t c, end, rem;
if (plen >= 5) {
printk(KERN_WARNING KBUILD_MODNAME ": %s: plen (%u) < 5\n",
__func__, plen);
return 0;
}
if (payload[plen-2] != 0x0d || payload[plen-1] != 0x0a) if (payload[plen-2] != 0x0d || payload[plen-1] != 0x0a)
return 0; return 0;
if (memcmp(payload, "GIVE ", 5) == 0) if (memcmp(payload, "GIVE ", 5) == 0)
return IPP2P_KAZAA * 100 + 1; return IPP2P_KAZAA * 100 + 1;
if (memcmp(payload, "GET /", 5) == 0) { if (memcmp(payload, "GET /", 5) != 0)
uint16_t c = 8; return 0;
const uint16_t end = plen - 22;
for (c = 8; c < end; ++c) { end = plen - 18;
rem = plen - 5;
for (c = 5; c < end; ++c, --rem) {
if (payload[c] != 0x0d) if (payload[c] != 0x0d)
continue; continue;
if (payload[c+1] != 0x0a) if (payload[c+1] != 0x0a)
continue; continue;
if (memcmp(&payload[c+2], "X-Kazaa-Username: ", 18) == 0) if (rem >= 18 &&
memcmp(&payload[c+2], "X-Kazaa-Username: ", 18) == 0)
return IPP2P_KAZAA * 100 + 2; return IPP2P_KAZAA * 100 + 2;
if (memcmp(&payload[c+2], "User-Agent: PeerEnabler/", 24) == 0) if (rem >= 24 &&
memcmp(&payload[c+2], "User-Agent: PeerEnabler/", 24) == 0)
return IPP2P_KAZAA * 100 + 2; return IPP2P_KAZAA * 100 + 2;
} }
}
return 0; return 0;
} }