Bail out if we do not have a meaningful amount of data in the packet …

…to work with.
jwise · Nov 17, 2014 · e6efe07 · sideeffect42 · Nov 17, 2014 · jwise
1 parent a4cabdf
commit e6efe07
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 2 deletions.
diff --git a/HoRNDIS-Info.plist b/HoRNDIS-Info.plist
@@ -13,13 +13,13 @@
 	<key>CFBundleIdentifier</key>
 	<string>com.joshuawise.kexts.HoRNDIS</string>
 	<key>CFBundleInfoDictionaryVersion</key>
-	<string>6.0</string>
+	<string>7.1</string>
 	<key>CFBundleName</key>
 	<string>HoRNDIS</string>
 	<key>CFBundlePackageType</key>
 	<string>KEXT</string>
 	<key>CFBundleShortVersionString</key>
-	<string>6</string>
+	<string>7.1</string>
 	<key>CFBundleSignature</key>
 	<string>????</string>
 	<key>CFBundleVersion</key>

diff --git a/HoRNDIS.cpp b/HoRNDIS.cpp
@@ -836,6 +836,11 @@ void HoRNDIS::receivePacket(void *packet, UInt32 size) {
 		struct rndis_data_hdr *hdr = (struct rndis_data_hdr *)packet;
 		uint32_t msg_len, data_ofs, data_len;
 
+		if (size <= sizeof(struct rndis_data_hdr)) {
+			LOG(V_ERROR, "receivePacket() on too small packet? (size %d)", size);
+			return;
+		}
+
 		msg_len = le32_to_cpu(hdr->msg_len);
 		data_ofs = le32_to_cpu(hdr->data_offset);
 		data_len = le32_to_cpu(hdr->data_len);