Add bounds check to SU3 fileNameLength (thanks psi).

monero-project · Feb 7, 2016 · d23138d · d23138d
1 parent 60e39ba
commit d23138d
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/src/core/Reseed.cpp b/src/core/Reseed.cpp
@@ -213,6 +213,11 @@ int Reseeder::ProcessSU3Stream(
       uint16_t fileNameLength, extraFieldLength;
       s.read(reinterpret_cast<char *>(&fileNameLength), 2);
       fileNameLength = le16toh(fileNameLength);
+      if (fileNameLength > 255) {
+        // TODO: avoid overflow with longer filenames
+        LogPrint(eLogError, "Reseed: SU3 fileNameLength too large: ", int(fileNameLength));
+        return numFiles;
+      }
       s.read(reinterpret_cast<char *>(&extraFieldLength), 2);
       extraFieldLength = le16toh(extraFieldLength);
       char localFileName[255];