connection: Prevent pointer overflow from large lengths.
authorMichal Srb <msrb@suse.com>
Tue, 14 Aug 2018 11:07:53 +0000 (13:07 +0200)
committerDerek Foreman <derek.foreman.samsung@gmail.com>
Fri, 17 Aug 2018 15:59:20 +0000 (10:59 -0500)
commitf7fdface41a9205c12aedf7fe04aba7792402909
treed9ee5cf00ae47ef34504131f0be063f581998684
parentf5b9e3b9a1df83ec3a6d219d7c28a1ac5bc0f339
connection: Prevent pointer overflow from large lengths.

If the remote side sends sufficiently large `length` field, it will
overflow the `p` pointer. Technically it is undefined behavior, in
practice it makes `p < end`, so the length check passes. Attempts to
access the data later causes crashes.

This issue manifests only on 32bit systems, but the behavior is
undefined everywhere.
Reviewed-by: Pekka Paalanen <pekka.paalanen@collabora.co.uk>
Reviewed-by: Derek Foreman <derek.foreman.samsung@gmail.com>
src/connection.c