[Title] fix the untrusted value as argument.

[Desc.] modify libvmodem/libvgsm_init.c, lxtutil.c

diff --git a/libvmodem/libvgsm_init.c b/libvmodem/libvgsm_init.c
index ddd3c2e..29b7891 100644 (file)
--- a/libvmodem/libvgsm_init.c
+++ b/libvmodem/libvgsm_init.c
@@ -383,7 +383,7 @@ static int lxt_callback(LXT_HANDLE* handle)
        }
 
        // check length
-       if (packet.length > 0)
+       if (packet.length != 0)
        {
                // allocated memory
                packet.data = malloc(packet.length);

diff --git a/libvmodem/lxtutil.c b/libvmodem/lxtutil.c
index d386b0d..7991f62 100644 (file)
--- a/libvmodem/lxtutil.c
+++ b/libvmodem/lxtutil.c
@@ -51,6 +51,7 @@
 int lxt_util_readRawBytes(int fd, void *data, int size)
 {
     int rc;
+    LXT_MESSAGE tmp_buf;
 
     // check
     if ( (data == 0) || (fd < 0) )
@@ -62,7 +63,11 @@ int lxt_util_readRawBytes(int fd, void *data, int size)
         return -1;
     }
 
-    rc = read(fd, data, size);
+    rc = read(fd, &tmp_buf, size);
+
+    ((LXT_MESSAGE*)data)->length = (unsigned short)tmp_buf.length;
+    ((LXT_MESSAGE*)data)->group = (unsigned char)tmp_buf.group;
+    ((LXT_MESSAGE*)data)->action = (unsigned char)tmp_buf.action;
 
     if (rc <= 0)
     {