[Title] fix the untrusted value as argument.

[Desc.] modify libvmodem/libvgsm_init.c, lxtutil.c

diff --git a/libvmodem/libvgsm_init.c b/libvmodem/libvgsm_init.c
index ddd3c2e993dbe92e2a8e99a361dc761fe5666881..29b78913ab96c44f4e652eb4473c3af434a661fb 100644 (file)
--- a/libvmodem/libvgsm_init.c
+++ b/libvmodem/libvgsm_init.c
@@ -383,7 +383,7 @@ static int lxt_callback(LXT_HANDLE* handle)
        }
 
        // check length
-       if (packet.length > 0)
+       if (packet.length != 0)
        {
                // allocated memory
                packet.data = malloc(packet.length);

diff --git a/libvmodem/lxtutil.c b/libvmodem/lxtutil.c
index d386b0dd92325bc05c8a908f14c08db7d9fe2a45..7991f62947d312efd9a92bfcd4299c8abf31491e 100644 (file)
--- a/libvmodem/lxtutil.c
+++ b/libvmodem/lxtutil.c
@@ -51,6 +51,7 @@
 int lxt_util_readRawBytes(int fd, void *data, int size)
 {
     int rc;
+    LXT_MESSAGE tmp_buf;
 
     // check
     if ( (data == 0) || (fd < 0) )
@@ -62,7 +63,11 @@ int lxt_util_readRawBytes(int fd, void *data, int size)
         return -1;
     }
 
-    rc = read(fd, data, size);
+    rc = read(fd, &tmp_buf, size);
+
+    ((LXT_MESSAGE*)data)->length = (unsigned short)tmp_buf.length;
+    ((LXT_MESSAGE*)data)->group = (unsigned char)tmp_buf.group;
+    ((LXT_MESSAGE*)data)->action = (unsigned char)tmp_buf.action;
 
     if (rc <= 0)
     {