diff options
| author | sudden6 <sudden6@gmx.at> | 2019-08-04 16:04:01 +0200 |
|---|---|---|
| committer | sudden6 <sudden6@gmx.at> | 2019-08-04 16:38:53 +0200 |
| commit | 3d21e66a8a7bf06507f8e62a5cc78f89f86adbc7 (patch) | |
| tree | 6d5e1567d4e59870b6ea8a0c5a0c17ee6716388c /toxcore | |
| parent | 8ed83c3d4c13b059c2645c176ab7789541a4374b (diff) | |
fix overflow in peer nick len
Diffstat (limited to 'toxcore')
| -rw-r--r-- | toxcore/group.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/toxcore/group.c b/toxcore/group.c index c1779ef9..12ad2f98 100644 --- a/toxcore/group.c +++ b/toxcore/group.c | |||
| @@ -3328,6 +3328,11 @@ static State_Load_Status load_conferences(Group_Chats *g_c, const uint8_t *data, | |||
| 3328 | data += sizeof(uint64_t); | 3328 | data += sizeof(uint64_t); |
| 3329 | 3329 | ||
| 3330 | peer->nick_len = *data; | 3330 | peer->nick_len = *data; |
| 3331 | |||
| 3332 | if (peer->nick_len > MAX_NAME_LENGTH) { | ||
| 3333 | return STATE_LOAD_STATUS_ERROR; | ||
| 3334 | } | ||
| 3335 | |||
| 3331 | ++data; | 3336 | ++data; |
| 3332 | 3337 | ||
| 3333 | if (length < (uint32_t)(data - init_data) + peer->nick_len) { | 3338 | if (length < (uint32_t)(data - init_data) + peer->nick_len) { |