author | mjm <mjm> | 2002-12-28 15:45:35 (UTC) |
---|---|---|
committer | mjm <mjm> | 2002-12-28 15:45:35 (UTC) |
commit | 3e11085619fabc4d25bb831bebbae189accfe4bf (patch) (side-by-side diff) | |
tree | e6f15cf4c707bbd5577eed364b01f20f152ede14 /noncore/net/wellenreiter/libwellenreiter/source/wl_proto.cc | |
parent | b8ade08c754775d594192e79f33ea9ecc1a3686c (diff) | |
download | opie-3e11085619fabc4d25bb831bebbae189accfe4bf.zip opie-3e11085619fabc4d25bb831bebbae189accfe4bf.tar.gz opie-3e11085619fabc4d25bb831bebbae189accfe4bf.tar.bz2 |
securityfix for get_field, updated header file
Diffstat (limited to 'noncore/net/wellenreiter/libwellenreiter/source/wl_proto.cc') (more/less context) (show whitespace changes)
-rw-r--r-- | noncore/net/wellenreiter/libwellenreiter/source/wl_proto.cc | 20 |
1 files changed, 12 insertions, 8 deletions
diff --git a/noncore/net/wellenreiter/libwellenreiter/source/wl_proto.cc b/noncore/net/wellenreiter/libwellenreiter/source/wl_proto.cc index 3d5a923..0630d04 100644 --- a/noncore/net/wellenreiter/libwellenreiter/source/wl_proto.cc +++ b/noncore/net/wellenreiter/libwellenreiter/source/wl_proto.cc @@ -9,7 +9,7 @@ #include "wl_sock.hh" /* Adds a field to the buffer */ -int add_field(char *buffer, char *string, int len) +int add_field(char *buffer, const char *string, int len) { char newlen[5]; @@ -24,7 +24,7 @@ int add_field(char *buffer, char *string, int len) return (atoi(newlen) + 3); } -int get_field(const char *buffer, char *out) +int get_field(const char *buffer, char *out, int maxlen) { char len[5]; @@ -32,7 +32,11 @@ int get_field(const char *buffer, char *out) memcpy(len, buffer, 3); /* Copy buffer to out pointer */ - memset(out, 0, atoi(len) + 1); + memset(out, 0, maxlen); + + if(atoi(len)-3 > maxlen -1) + memcpy(out, buffer + 3, maxlen - 1); + else memcpy(out, buffer + 3, atoi(len)); /* Return length of whole field (including 3 byte length) */ @@ -100,24 +104,24 @@ int get_network_found (void *structure, const char *buffer) /* Get net type (accesspoint || ad-hoc || ...) */ memset(temp, 0, sizeof(temp)); - len += get_field(buffer + len, temp); + len += get_field(buffer + len, temp, sizeof(temp)); ptr->net_type = atoi(temp); /* Get channel */ memset(temp, 0, sizeof(temp)); - len += get_field(buffer + len, temp); + len += get_field(buffer + len, temp, sizeof(temp)); ptr->channel = atoi(temp); /* Set WEP y/n */ memset(temp, 0, sizeof(temp)); - len += get_field(buffer + len, temp); + len += get_field(buffer + len, temp, sizeof(temp)); ptr->wep = atoi(temp); /* Set MAC address */ - len += get_field(buffer + len, ptr->mac); + len += get_field(buffer + len, ptr->mac, sizeof(ptr->mac)); /* Set BSSID */ - len += get_field(buffer + len, ptr->bssid); + len += get_field(buffer + len, ptr->bssid, sizeof(ptr->bssid)); return 1; } |