mirror of
https://git.libssh.org/projects/libssh.git
synced 2025-11-29 01:03:57 +03:00
buffer: Abort if the canary is not intact in ssh_buffer_unpack()
Signed-off-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Aris Adamantiadis <aris@0xbadc0de.be>
This commit is contained in:
@@ -961,10 +961,10 @@ int ssh_buffer_unpack_va(struct ssh_buffer_struct *buffer,
|
||||
}
|
||||
|
||||
if (rc != SSH_ERROR){
|
||||
/* verify that the last hidden argument is correct */
|
||||
/* Check if our canary is intact, if not somthing really bad happened */
|
||||
uint32_t canary = va_arg(ap, uint32_t);
|
||||
if (canary != SSH_BUFFER_PACK_END){
|
||||
rc = SSH_ERROR;
|
||||
abort();
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user