firebird/firebird-mirror
firebird/firebird-mirror
8
0
Fork 1
mirror of https://github.com/FirebirdSQL/firebird.git synced 2025-01-24 18:03:02 +01:00
Code Issues

Fixed CORE-4630: Segfault in server caused by bad packet

Browse Source
This commit is contained in:
alexpeshkoff 2014-12-02 10:18:26 +00:00
parent c80929e9ef
commit d310e46851
1 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/remote/protocol.cpp
View File

@ -398,6 +398,8 @@ bool_t xdr_protocol(XDR* xdrs, PACKET* p)
MAP(xdr_short, reinterpret_cast<SSHORT&>(response->p_resp_object)); MAP(xdr_short, reinterpret_cast<SSHORT&>(response->p_resp_object));
MAP(xdr_quad, response->p_resp_blob_id); MAP(xdr_quad, response->p_resp_blob_id);
MAP(xdr_cstring, response->p_resp_data); MAP(xdr_cstring, response->p_resp_data);
if (!response->p_resp_status_vector) // incorrectly called - packet not prepared
return P_FALSE(xdrs, p);
return xdr_status_vector(xdrs, response->p_resp_status_vector) ? return xdr_status_vector(xdrs, response->p_resp_status_vector) ?
P_TRUE(xdrs, p) : P_FALSE(xdrs, p); P_TRUE(xdrs, p) : P_FALSE(xdrs, p);
@ -1652,9 +1654,12 @@ static bool_t xdr_status_vector(XDR* xdrs, ISC_STATUS* vector)
SLONG vec; SLONG vec;
SCHAR* sp = NULL; SCHAR* sp = NULL;
ISC_STATUS* const end = &vector[ISC_STATUS_LENGTH];
while (true) while (true)
{ {
if (vector >= end)
return FALSE;
if (xdrs->x_op == XDR_ENCODE) if (xdrs->x_op == XDR_ENCODE)
vec = (SLONG) * vector++; vec = (SLONG) * vector++;
if (!xdr_long(xdrs, &vec)) if (!xdr_long(xdrs, &vec))
@ -1670,6 +1675,8 @@ static bool_t xdr_status_vector(XDR* xdrs, ISC_STATUS* vector)
case isc_arg_interpreted: case isc_arg_interpreted:
case isc_arg_string: case isc_arg_string:
case isc_arg_sql_state: case isc_arg_sql_state:
if (vector >= end)
return FALSE;
if (xdrs->x_op == XDR_ENCODE) if (xdrs->x_op == XDR_ENCODE)
{ {
if (!xdr_wrapstring(xdrs, reinterpret_cast<SCHAR**>(vector++))) if (!xdr_wrapstring(xdrs, reinterpret_cast<SCHAR**>(vector++)))
@ -1700,6 +1707,8 @@ static bool_t xdr_status_vector(XDR* xdrs, ISC_STATUS* vector)
case isc_arg_number: case isc_arg_number:
default: default:
if (vector >= end)
return FALSE;
if (xdrs->x_op == XDR_ENCODE) if (xdrs->x_op == XDR_ENCODE)
vec = (SLONG) * vector++; vec = (SLONG) * vector++;
if (!xdr_long(xdrs, &vec)) if (!xdr_long(xdrs, &vec))