devs/libstrophe-gh
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix potential infinite looping of resolver

Browse Source 
In case a pointer to itself was received, the resolver looped inifinitely
until the stack overflows.

Signed-off-by: Steffen Jaeckel <jaeckel-floss@eyet-services.de>
This commit is contained in:
Steffen Jaeckel
2022-03-06 18:47:48 +01:00
parent 1406198087
commit 870f2174d5
2 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
ChangeLog
View File

@@ -1,4 +1,5 @@
0.12.0 0.12.0
- Fix potential infinite loop in resolver (#200)
- Add code coverage support - Add code coverage support
- New API: - New API:
- xmpp_stanza_get_child_by_path() - xmpp_stanza_get_child_by_path()

3
src/resolver.c
View File

@@ -321,6 +321,9 @@ static unsigned message_name_get(const unsigned char *buf,
if (i >= buf_len) if (i >= buf_len)
return 0; return 0;
pointer = (label_len & 0x3f) << 8 | buf[i++]; pointer = (label_len & 0x3f) << 8 | buf[i++];
/* Prevent infinite looping */
if (pointer == buf_offset)
return 0;
if (name != NULL && name_len >= name_max && name_max > 0) { if (name != NULL && name_len >= name_max && name_max > 0) {
/* We have filled the name buffer. Don't pass it recursively. */ /* We have filled the name buffer. Don't pass it recursively. */
name[name_max - 1] = '\0'; name[name_max - 1] = '\0';