firebird/firebird-mirror
firebird/firebird-mirror
8
0
Fork 1
mirror of https://github.com/FirebirdSQL/firebird.git synced 2025-01-24 09:23:03 +01:00
Code Issues

backported fix for AV related with too many protocol versions in connect packet

Browse Source
This commit is contained in:
alexpeshkoff 2006-11-12 14:25:48 +00:00
parent ca7dfc361d
commit 66c3cb5e14
1 changed files with 38 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
src/remote/protocol.cpp
View File

@ -305,6 +305,7 @@ bool_t xdr_protocol(XDR* xdrs, PACKET* p)
return P_TRUE(xdrs, p); return P_TRUE(xdrs, p);
case op_connect: case op_connect:
{
connect = &p->p_cnct; connect = &p->p_cnct;
MAP(xdr_enum, MAP(xdr_enum,
reinterpret_cast<xdr_op&>(connect->p_cnct_operation)); reinterpret_cast<xdr_op&>(connect->p_cnct_operation));
@ -315,9 +316,18 @@ bool_t xdr_protocol(XDR* xdrs, PACKET* p)
MAP(xdr_short, reinterpret_cast<SSHORT&>(connect->p_cnct_count)); MAP(xdr_short, reinterpret_cast<SSHORT&>(connect->p_cnct_count));
MAP(xdr_cstring, connect->p_cnct_user_id); MAP(xdr_cstring, connect->p_cnct_user_id);
const size_t CNCT_VERSIONS = FB_NELEM(connect->p_cnct_versions);
for (i = 0, tail = connect->p_cnct_versions; for (i = 0, tail = connect->p_cnct_versions;
i < connect->p_cnct_count; i++, tail++) i < connect->p_cnct_count; i++, tail++)
{ {
// ignore the rest of protocols in case of too many suggested versions
p_cnct::p_cnct_repeat dummy;
if (i >= CNCT_VERSIONS)
{
tail = &dummy;
}
MAP(xdr_short, MAP(xdr_short,
reinterpret_cast<SSHORT&>(tail->p_cnct_version)); reinterpret_cast<SSHORT&>(tail->p_cnct_version));
MAP(xdr_enum, MAP(xdr_enum,
@ -327,8 +337,16 @@ bool_t xdr_protocol(XDR* xdrs, PACKET* p)
MAP(xdr_short, MAP(xdr_short,
reinterpret_cast<SSHORT&>(tail->p_cnct_weight)); reinterpret_cast<SSHORT&>(tail->p_cnct_weight));
} }
// ignore the rest of protocols in case of too many suggested versions
if (connect->p_cnct_count > CNCT_VERSIONS)
{
connect->p_cnct_count = CNCT_VERSIONS;
}
DEBUG_PRINTSIZE(xdrs, p->p_operation); DEBUG_PRINTSIZE(xdrs, p->p_operation);
return P_TRUE(xdrs, p); return P_TRUE(xdrs, p);
}
case op_accept: case op_accept:
accept = &p->p_acpt; accept = &p->p_acpt;