|
 |
43ff50 |
commit 43b2f5d1207a010f1df67e101b129b09502371e2
|
|
|
43ff50 |
Author: Hangbin Liu <liuhangbin@gmail.com>
|
|
|
43ff50 |
Date: Fri May 12 15:36:45 2017 +0800
|
|
|
43ff50 |
|
|
|
43ff50 |
msg: use last_tlv if there is not enough room for another tlv
|
|
|
43ff50 |
|
|
|
43ff50 |
If the len is not enought for another tlv process. e.g. one more bytes
|
|
|
43ff50 |
padding at the end of message. And we set extra to NULL instead of
|
|
|
43ff50 |
msg->last_tlv in tlv_post_recv(). Then the msg->last_tlv will not be
|
|
|
43ff50 |
initialised. And program will crash if we read msg->last_tlv. e.g. in
|
|
|
43ff50 |
function pmc_show().
|
|
|
43ff50 |
|
|
|
43ff50 |
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
|
|
|
43ff50 |
|
|
|
43ff50 |
diff --git a/msg.c b/msg.c
|
|
|
43ff50 |
index a38b815..4b3d926 100644
|
|
|
43ff50 |
--- a/msg.c
|
|
|
43ff50 |
+++ b/msg.c
|
|
|
43ff50 |
@@ -140,7 +140,7 @@ static int suffix_post_recv(uint8_t *ptr, int len, struct tlv_extra *last)
|
|
|
43ff50 |
}
|
|
|
43ff50 |
len -= tlv->length;
|
|
|
43ff50 |
ptr += tlv->length;
|
|
|
43ff50 |
- err = tlv_post_recv(tlv, len ? NULL : last);
|
|
|
43ff50 |
+ err = tlv_post_recv(tlv, len > sizeof(struct TLV) ? NULL : last);
|
|
|
43ff50 |
if (err)
|
|
|
43ff50 |
return err;
|
|
|
43ff50 |
}
|
|
|
43ff50 |
commit 95b5a13cb2787b6a436ad395bb4931d1661e59a7
|
|
|
43ff50 |
Author: Hangbin Liu <liuhangbin@gmail.com>
|
|
|
43ff50 |
Date: Tue May 23 14:49:55 2017 +0800
|
|
|
43ff50 |
|
|
|
43ff50 |
pmc: goto out when get unknown management tlv
|
|
|
43ff50 |
|
|
|
43ff50 |
If handle unknown management tlv. The management message id and format are
|
|
|
43ff50 |
also unknown, thus we may crash due to access unknown area.
|
|
|
43ff50 |
|
|
|
43ff50 |
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
|
|
|
43ff50 |
|
|
|
43ff50 |
diff --git a/pmc.c b/pmc.c
|
|
|
43ff50 |
index cefa771..af9cc63 100644
|
|
|
43ff50 |
--- a/pmc.c
|
|
|
43ff50 |
+++ b/pmc.c
|
|
|
43ff50 |
@@ -217,6 +217,7 @@ static void pmc_show(struct ptp_message *msg, FILE *fp)
|
|
|
43ff50 |
goto out;
|
|
|
43ff50 |
} else {
|
|
|
43ff50 |
fprintf(fp, "unknown-tlv ");
|
|
|
43ff50 |
+ goto out;
|
|
|
43ff50 |
}
|
|
|
43ff50 |
mgt = (struct management_tlv *) msg->management.suffix;
|
|
|
43ff50 |
if (mgt->length == 2 && mgt->id != TLV_NULL_MANAGEMENT) {
|