GitLab/ocserv
1
0
Fork 0
mirror of https://gitlab.com/openconnect/ocserv.git synced 2026-08-09 09:51:49 +08:00
Code Issues Packages Projects Releases Wiki Activity

parse_data(): ensure sanity checks for safety

Browse Source 
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
This commit is contained in:
Nikos Mavrogiannopoulos
2026-06-07 08:29:52 +02:00
parent 9866624118
commit b7a73b968d
1 changed files with 14 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/worker-vpn.c
+14
View File
@@ -41,6 +41,7 @@ static inline void worker_exit(int status)
#include <inttypes.h> #include <inttypes.h>
#include <stdlib.h> #include <stdlib.h>
#include <stdarg.h> #include <stdarg.h>
#include <assert.h>
#include <stdio.h> #include <stdio.h>
#include <string.h> #include <string.h>
#include <sys/types.h> #include <sys/types.h>
@@ -2697,6 +2698,9 @@ static int parse_data(struct worker_st *ws, uint8_t *buf, size_t buf_size,
head = buf[0]; head = buf[0];
} }
/* Caller ensures there is enough data */
assert(plain_size >= 0);
switch (head) { switch (head) {
case AC_PKT_DPD_RESP: case AC_PKT_DPD_RESP:
oclog(ws, LOG_TRANSFER_DEBUG, "received DPD response"); oclog(ws, LOG_TRANSFER_DEBUG, "received DPD response");
@@ -2779,6 +2783,11 @@ static int parse_data(struct worker_st *ws, uint8_t *buf, size_t buf_size,
exit_worker_reason(ws, REASON_TEMP_DISCONNECT); exit_worker_reason(ws, REASON_TEMP_DISCONNECT);
case AC_PKT_COMPRESSED: case AC_PKT_COMPRESSED:
if (plain_size == 0) {
oclog(ws, LOG_TRANSFER_DEBUG, "received empty packet");
return 0;
}
/* decompress */ /* decompress */
if (is_dtls == 0) { /* CSTP */ if (is_dtls == 0) { /* CSTP */
if (ws->cstp_selected_comp == NULL) { if (ws->cstp_selected_comp == NULL) {
@@ -2814,6 +2823,11 @@ static int parse_data(struct worker_st *ws, uint8_t *buf, size_t buf_size,
plain = ws->decomp; plain = ws->decomp;
/* fall through */ /* fall through */
case AC_PKT_DATA: case AC_PKT_DATA:
if (plain_size == 0) {
oclog(ws, LOG_TRANSFER_DEBUG, "received empty packet");
return 0;
}
oclog(ws, LOG_TRANSFER_DEBUG, "writing %zd byte(s) to TUN", oclog(ws, LOG_TRANSFER_DEBUG, "writing %zd byte(s) to TUN",
plain_size); plain_size);