mirror/openldap
2
0
Fork 0
mirror of https://git.openldap.org/openldap/openldap.git synced 2024-12-21 03:10:25 +08:00
Code Issues Packages Projects Releases Wiki Activity

Use fixed sizes for ber_get_next to avoid 64-bit hangs.

Browse Source
This commit is contained in:
Howard Chu 2003-03-02 04:02:39 +00:00
parent 2d942d7035
commit ec497cf529
1 changed files with 17 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
libraries/liblber/io.c
View File

@ -456,6 +456,8 @@ ber_reset( BerElement *ber, int was_writing )
* a full packet is read.
*/
#define LENSIZE 4
ber_tag_t
ber_get_next(
Sockbuf *sb,
@ -486,6 +488,15 @@ ber_get_next(
* 1) small tags (less than 128)
* 2) definite lengths
* 3) primitive encodings used whenever possible
*
* The code also handles multi-byte tags. The first few bytes
* of the message are read to check for multi-byte tags and
* lengths. These bytes are temporarily stored in the ber_tag,
* ber_len, and ber_usertag fields of the berelement until
* tag/len parsing is complete. After this parsing, any leftover
* bytes and the rest of the message are copied into the ber_buf.
*
* We expect tag and len to be at most 32 bits wide.
*/
if (ber->ber_rwptr == NULL) {
@ -499,13 +510,13 @@ ber_get_next(
}
while (ber->ber_rwptr > (char *)&ber->ber_tag && ber->ber_rwptr <
(char *)(&ber->ber_usertag + 1)) {
(char *)&ber->ber_len + LENSIZE*2) {
ber_slen_t sblen;
char buf[sizeof(ber->ber_len)-1];
char buf[LENSIZE-1];
ber_len_t tlen = 0;
sblen=ber_int_sb_read( sb, ber->ber_rwptr,
(char *)(&ber->ber_usertag+1)-ber->ber_rwptr);
((char *)&ber->ber_len + LENSIZE*2)-ber->ber_rwptr);
if (sblen<=0) return LBER_DEFAULT;
ber->ber_rwptr += sblen;
@ -563,11 +574,11 @@ ber_get_next(
}
/* Are there leftover data bytes inside ber->ber_len? */
if (ber->ber_ptr < (char *)&ber->ber_usertag) {
if (ber->ber_rwptr < (char *)&ber->ber_usertag)
if (ber->ber_ptr < (char *)&ber->ber_len+LENSIZE) {
if (ber->ber_rwptr < (char *)&ber->ber_len+LENSIZE)
sblen = ber->ber_rwptr - ber->ber_ptr;
else
sblen = (char *)&ber->ber_usertag - ber->ber_ptr;
sblen = ((char *)&ber->ber_len+LENSIZE) - ber->ber_ptr;
AC_MEMCPY(buf, ber->ber_ptr, sblen);
ber->ber_ptr += sblen;
} else {