mirror of
https://github.com/PurpleI2P/i2pd
synced 2024-11-10 00:00:29 +03:00
check tunnel payload size
This commit is contained in:
parent
30f68759ff
commit
8061d306dd
@ -482,6 +482,11 @@ namespace tunnel
|
||||
uint16_t len = bufbe16toh(payload + TUNNEL_GATEWAY_HEADER_LENGTH_OFFSET);
|
||||
// we make payload as new I2NP message to send
|
||||
msg->offset += I2NP_HEADER_SIZE + TUNNEL_GATEWAY_HEADER_SIZE;
|
||||
if (msg->offset + len > msg->len)
|
||||
{
|
||||
LogPrint (eLogError, "Tunnel: gateway payload ", (int)len, " exceeds message length ", (int)msg->len);
|
||||
return;
|
||||
}
|
||||
msg->len = msg->offset + len;
|
||||
auto typeID = msg->GetTypeID ();
|
||||
LogPrint (eLogDebug, "Tunnel: gateway of ", (int) len, " bytes for tunnel ", tunnel->GetTunnelID (), ", msg type ", (int)typeID);
|
||||
|
@ -90,6 +90,11 @@ namespace tunnel
|
||||
|
||||
msg->offset = fragment - msg->buf;
|
||||
msg->len = msg->offset + size;
|
||||
if (msg->len > msg->maxLen)
|
||||
{
|
||||
LogPrint (eLogError, "TunnelMessage: fragment is too long ", (int)size);
|
||||
return;
|
||||
}
|
||||
if (fragment + size < decrypted + TUNNEL_DATA_ENCRYPTED_SIZE)
|
||||
{
|
||||
// this is not last message. we have to copy it
|
||||
|
Loading…
Reference in New Issue
Block a user