mirror/lwip
1
0
Fork 0
mirror of https://github.com/lwip-tcpip/lwip.git synced 2025-01-01 20:57:54 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix pbuf_memcmp() implementation by using pbuf_try_get_at() instead of pbuf_get_at(). Payload out-of-bounds access was not handled correctly.

Browse Source
This commit is contained in:
Dirk Ziegelmeier 2016-08-31 10:35:42 +02:00
parent 23147b0e21
commit 4325aca0f7
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/core/pbuf.c
View File

@ -1310,8 +1310,11 @@ pbuf_memcmp(struct pbuf* p, u16_t offset, const void* s2, u16_t n)
if ((q != NULL) && (q->len > start)) { if ((q != NULL) && (q->len > start)) {
u16_t i; u16_t i;
for (i = 0; i < n; i++) { for (i = 0; i < n; i++) {
u8_t a = pbuf_get_at(q, start + i);
u8_t b = ((const u8_t*)s2)[i]; u8_t b = ((const u8_t*)s2)[i];
int a = pbuf_try_get_at(q, start + i);
if (a < 0) {
return 0xffff;
}
if (a != b) { if (a != b) {
return i+1; return i+1;
} }