generic-library/libupnp
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Handle overflow in http_SendMessage.

Browse Source
This commit is contained in:
Yoichi NAKAYAMA 2012-03-11 03:33:14 +09:00
parent 56b44fee91
commit d952ebfb44
2 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
ChangeLog
View File

@ -11,6 +11,7 @@ Version 1.6.16
* Handle SearchByTarget error in UpnpSearchAsync. * Handle SearchByTarget error in UpnpSearchAsync.
* Pass output buffer size to addrToString and detect overflow. * Pass output buffer size to addrToString and detect overflow.
* Handle addrToString error in configure_urlbase. * Handle addrToString error in configure_urlbase.
* Handle overflow in http_SendMessage.
* Treat large argument as error in UpnpAddVirtualDir. * Treat large argument as error in UpnpAddVirtualDir.
* Do not clear buffer before snprintf. * Do not clear buffer before snprintf.
* Clarify the last argument of GetDescDocumentAndURL has size LINE_SIZE. * Clarify the last argument of GetDescDocumentAndURL has size LINE_SIZE.

8
upnp/src/genlib/net/http/httpreadwrite.c
View File

@ -446,15 +446,19 @@ int http_SendMessage(SOCKINFO *info, int *TimeOut, const char *fmt, ...)
} }
/* Create chunk for the current buffer. */ /* Create chunk for the current buffer. */
if (Instr && Instr->IsChunkActive) { if (Instr && Instr->IsChunkActive) {
int rc;
/* Copy CRLF at the end of the chunk */ /* Copy CRLF at the end of the chunk */
memcpy(file_buf + num_read, "\r\n", 2); memcpy(file_buf + num_read, "\r\n", 2);
/* Hex length for the chunk size. */ /* Hex length for the chunk size. */
memset(Chunk_Header, 0, memset(Chunk_Header, 0,
sizeof(Chunk_Header)); sizeof(Chunk_Header));
snprintf(Chunk_Header, rc = snprintf(Chunk_Header,
sizeof(Chunk_Header) - strlen ("\r\n"), sizeof(Chunk_Header) - strlen ("\r\n"),
"%" PRIzx, num_read); "%" PRIzx, num_read);
/*itoa(num_read,Chunk_Header,16); */ if (rc < 0 || (unsigned int) rc >= sizeof(Chunk_Header) - strlen ("\r\n")) {
RetVal = UPNP_E_INTERNAL_ERROR;
goto Cleanup_File;
}
strncat(Chunk_Header, "\r\n", strlen ("\r\n")); strncat(Chunk_Header, "\r\n", strlen ("\r\n"));
/* Copy the chunk size header */ /* Copy the chunk size header */
memcpy(file_buf - strlen(Chunk_Header), memcpy(file_buf - strlen(Chunk_Header),