i2p/haiku-beta6
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fixed the Dano message reader:

Browse Source 
* The size returned was too big, as the size in the flattened message included
  the message format.
* Made it a bit more robust, too (bail out if the section header size is smaller
  than zero).


git-svn-id: file:///srv/svn/repos/haiku/haiku/trunk@17772 a95241bf-73f2-0310-859d-f6bbb57e9c96
This commit is contained in:
Axel Dörfler
2006-06-07 20:39:32 +00:00
parent 4274405a4c
commit 58c7d50a41
1 changed files with 14 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/kits/app/dano_message.cpp
+14 -9
View File
@@ -1,5 +1,5 @@
/* /*
* Copyright 2005, Haiku. * Copyright 2005-2006, Haiku.
* Distributed under the terms of the MIT License. * Distributed under the terms of the MIT License.
* *
* Authors: * Authors:
@@ -84,10 +84,13 @@ BPrivate::dano_message_flattened_size(const char *buffer)
{ {
section_header *header = (section_header *)buffer; section_header *header = (section_header *)buffer;
if (header->code == kMessageFormatSwapped) // The size contains the message format that won't be part of
return __swap_int32(header->size); // the buffer unflatten_dano_message() will get
return header->size; if (header->code == kMessageFormatSwapped)
return __swap_int32(header->size) - sizeof(header->code);
return header->size - sizeof(header->code);
} }
@@ -118,7 +121,7 @@ BPrivate::unflatten_dano_message(uint32 format, BDataIO &stream,
// be safe. this shouldn't be necessary but in some testcases it was. // be safe. this shouldn't be necessary but in some testcases it was.
sectionHeader.size = pad_to_8(sectionHeader.size); sectionHeader.size = pad_to_8(sectionHeader.size);
if (offset + sectionHeader.size > size) if (offset + sectionHeader.size > size || sectionHeader.size < 0)
return B_BAD_DATA; return B_BAD_DATA;
ssize_t fieldSize = sectionHeader.size - sizeof(section_header); ssize_t fieldSize = sectionHeader.size - sizeof(section_header);
@@ -133,10 +136,12 @@ BPrivate::unflatten_dano_message(uint32 format, BDataIO &stream,
} }
switch (sectionHeader.code) { switch (sectionHeader.code) {
case SECTION_OFFSET_TABLE: break; /* discard */ case SECTION_OFFSET_TABLE:
case SECTION_TARGET_INFORMATION: break; /* discard */ case SECTION_TARGET_INFORMATION:
case SECTION_SORTED_INDEX_TABLE: break; /* discard */ case SECTION_SORTED_INDEX_TABLE:
case SECTION_END_OF_DATA: break; /* discard */ case SECTION_END_OF_DATA:
// discard
break;
case SECTION_SINGLE_ITEM_DATA: { case SECTION_SINGLE_ITEM_DATA: {
single_item *field = (single_item *)fieldBuffer; single_item *field = (single_item *)fieldBuffer;