1 files changed, 10 insertions, 12 deletions

diff --git a/toxcore/friend_requests.c b/toxcore/friend_requests.c
index 469ab02d..eb2a791c 100644
--- a/toxcore/friend_requests.c
+++ b/toxcore/friend_requests.c
@@ -37,10 +37,10 @@
  */
 int send_friendrequest(Onion_Client *onion_c, uint8_t *public_key, uint32_t nospam_num, uint8_t *data, uint32_t length)
 {
-    if (length + sizeof(nospam_num) > MAX_DATA_SIZE)
+    if (1 + sizeof(nospam_num) + length > ONION_CLIENT_MAX_DATA_SIZE || length == 0)
         return -1;
 
-    uint8_t temp[MAX_DATA_SIZE];
+    uint8_t temp[1 + sizeof(nospam_num) + length];
     temp[0] = CRYPTO_PACKET_FRIEND_REQ;
     memcpy(temp + 1, &nospam_num, sizeof(nospam_num));
     memcpy(temp + 1 + sizeof(nospam_num), data, length);
@@ -50,7 +50,7 @@ int send_friendrequest(Onion_Client *onion_c, uint8_t *public_key, uint32_t nosp
     if (friend_num == -1)
         return -1;
 
-    int num = send_onion_data(onion_c, friend_num, temp, 1 + sizeof(nospam_num) + length);
+    int num = send_onion_data(onion_c, friend_num, temp, sizeof(temp));
 
     if (num <= 0)
         return -1;
@@ -135,20 +135,17 @@ int remove_request_received(Friend_Requests *fr, uint8_t *client_id)
 
 static int friendreq_handlepacket(void *object, uint8_t *source_pubkey, uint8_t *packet, uint32_t length)
 {
-    if (length == 0)
+    Friend_Requests *fr = object;
+
+    if (length <= 1 + sizeof(fr->nospam) || length > ONION_CLIENT_MAX_DATA_SIZE)
         return 1;
 
     ++packet;
     --length;
 
-    Friend_Requests *fr = object;
-
     if (fr->handle_friendrequest_isset == 0)
         return 1;
 
-    if (length <= sizeof(fr->nospam))
-        return 1;
-
     if (request_received(fr, source_pubkey))
         return 1;
 
@@ -161,11 +158,12 @@ static int friendreq_handlepacket(void *object, uint8_t *source_pubkey, uint8_t
 
     addto_receivedlist(fr, source_pubkey);
 
-    uint8_t message[length - 4 + 1];
-    memcpy(message, packet + 4, length - 4);
+    uint32_t message_len = length - sizeof(fr->nospam);
+    uint8_t message[message_len + 1];
+    memcpy(message, packet + sizeof(fr->nospam), message_len);
     message[sizeof(message) - 1] = 0; /* Be sure the message is null terminated. */
 
-    (*fr->handle_friendrequest)(fr->handle_friendrequest_object, source_pubkey, message, length - 4,
+    (*fr->handle_friendrequest)(fr->handle_friendrequest_object, source_pubkey, message, message_len,
                                 fr->handle_friendrequest_userdata);
     return 0;
 }