lib/libssh
1
0
Fork 0
mirror of https://git.libssh.org/projects/libssh.git synced 2025-11-27 13:21:11 +03:00
Code Activity

Revert "buffer: Validate the length before before memory allocation"

Browse Source 
This reverts commit 57550e6211.
This commit is contained in:
Andreas Schneider
2017-04-13 16:19:23 +02:00
parent 57550e6211
commit 0cf1c85542
1 changed files with 2 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
src/buffer.c
View File

@@ -848,12 +848,10 @@ int ssh_buffer_unpack_va(struct ssh_buffer_struct *buffer,
char **cstring;
void **data;
} o;
size_t len, rlen, max_len;
size_t len, rlen;
va_list ap_copy;
int count;
max_len = ssh_buffer_get_len(buffer);
/* copy the argument list in case a rollback is needed */
va_copy(ap_copy, ap);
@@ -905,16 +903,10 @@ int ssh_buffer_unpack_va(struct ssh_buffer_struct *buffer,
break;
}
len = ntohl(u32len);
if (len > max_len - 1) {
if (len > UINT_MAX - 1){
rc = SSH_ERROR;
break;
}
rc = ssh_buffer_validate_length(buffer, len);
if (rc != SSH_OK) {
break;
}
*o.cstring = malloc(len + 1);
if (*o.cstring == NULL){
rc = SSH_ERROR;
@@ -933,15 +925,6 @@ int ssh_buffer_unpack_va(struct ssh_buffer_struct *buffer,
}
case 'P':
len = va_arg(ap, size_t);
if (len > max_len - 1) {
rc = SSH_ERROR;
break;
}
rc = ssh_buffer_validate_length(buffer, len);
if (rc != SSH_OK) {
break;
}
o.data = va_arg(ap, void **);
count++;