Mirrors/libwebsockets
1
0
Fork 0
mirror of https://github.com/warmcat/libwebsockets.git synced 2025-03-09 00:00:04 +01:00
Code Issues Releases Wiki Activity

fuzzer rx overflow mitigate

Browse source 
Signed-off-by: Andy Green <andy.green@linaro.org>
This commit is contained in:
Andy Green 2016-01-12 23:05:02 +08:00
parent 5b3736682d
commit 9928cccdb6
4 changed files with 7 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
lib/client.c
View file

@ -813,6 +813,7 @@ check_accept:
lwsl_err("Out of Mem allocating rx buffer %d\n", n);
goto bail2;
}
wsi->u.ws.rx_ubuf_alloc = n;
lwsl_info("Allocating client RX buffer %d\n", n);
if (setsockopt(wsi->sock, SOL_SOCKET, SO_SNDBUF, (const char *)&n,

4
lib/parsers.c
View file

@ -1016,6 +1016,10 @@ handle_first:
assert(wsi->u.ws.rx_ubuf);
if (wsi->u.ws.rx_ubuf_head + LWS_PRE + 4 >= wsi->u.ws.rx_ubuf_alloc) {
lwsl_err("Attempted overflow\n");
return -1;
}
if (wsi->u.ws.all_zero_nonce)
wsi->u.ws.rx_ubuf[LWS_PRE +
(wsi->u.ws.rx_ubuf_head++)] = c;

1
lib/private-libwebsockets.h
View file

@ -840,6 +840,7 @@ struct _lws_header_related {
struct _lws_websocket_related {
char *rx_ubuf;
unsigned int rx_ubuf_alloc;
struct lws *rx_draining_ext_list;
struct lws *tx_draining_ext_list;
size_t rx_packet_length;

1
lib/server.c
View file

@ -545,6 +545,7 @@ upgrade_ws:
lwsl_err("Out of Mem allocating rx buffer %d\n", n);
return 1;
}
wsi->u.ws.rx_ubuf_alloc = n;
lwsl_info("Allocating RX buffer %d\n", n);
#if LWS_POSIX
if (setsockopt(wsi->sock, SOL_SOCKET, SO_SNDBUF,