From cf63fa7276f99f6380fb07ed7ab0caa2b1753160 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Tue, 13 Mar 2018 18:54:08 +0100 Subject: [PATCH] stroke: Ensure a minimum message length Also includes f44b1eb4447085cff350bcd89dbcd080347b91f8 to terminate the message strings. --- src/libcharon/plugins/stroke/stroke_socket.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/src/libcharon/plugins/stroke/stroke_socket.c b/src/libcharon/plugins/stroke/stroke_socket.c index 56c18da38126..f56728b310b2 100644 --- a/src/libcharon/plugins/stroke/stroke_socket.c +++ b/src/libcharon/plugins/stroke/stroke_socket.c @@ -457,15 +457,23 @@ static job_requeue_t process(stroke_job_context_t *ctx) strerror(errno)); return JOB_REQUEUE_NONE; } + if (msg_length < offsetof(stroke_msg_t, buffer)) + { + DBG1(DBG_CFG, "invalid stroke message length %d", msg_length); + return JOB_REQUEUE_NONE; + } - /* read message */ - msg = alloca(msg_length); + /* read message (we need an additional byte to terminate the buffer) */ + msg = alloca(msg_length + 1); bytes_read = recv(strokefd, msg, msg_length, 0); if (bytes_read != msg_length) { DBG1(DBG_CFG, "reading stroke message failed: %s", strerror(errno)); return JOB_REQUEUE_NONE; } + /* make sure even incorrectly unterminated strings don't extend over the + * message boundaries */ + ((char*)msg)[msg_length] = '\0'; out = fdopen(strokefd, "w+"); if (out == NULL) -- 2.7.4