author | mjm <mjm> | 2002-12-28 15:45:35 (UTC) |
---|---|---|
committer | mjm <mjm> | 2002-12-28 15:45:35 (UTC) |
commit | 3e11085619fabc4d25bb831bebbae189accfe4bf (patch) (unidiff) | |
tree | e6f15cf4c707bbd5577eed364b01f20f152ede14 /noncore/net/wellenreiter/libwellenreiter/source/wl_proto.cc | |
parent | b8ade08c754775d594192e79f33ea9ecc1a3686c (diff) | |
download | opie-3e11085619fabc4d25bb831bebbae189accfe4bf.zip opie-3e11085619fabc4d25bb831bebbae189accfe4bf.tar.gz opie-3e11085619fabc4d25bb831bebbae189accfe4bf.tar.bz2 |
securityfix for get_field, updated header file
Diffstat (limited to 'noncore/net/wellenreiter/libwellenreiter/source/wl_proto.cc') (more/less context) (ignore whitespace changes)
-rw-r--r-- | noncore/net/wellenreiter/libwellenreiter/source/wl_proto.cc | 22 |
1 files changed, 13 insertions, 9 deletions
diff --git a/noncore/net/wellenreiter/libwellenreiter/source/wl_proto.cc b/noncore/net/wellenreiter/libwellenreiter/source/wl_proto.cc index 3d5a923..0630d04 100644 --- a/noncore/net/wellenreiter/libwellenreiter/source/wl_proto.cc +++ b/noncore/net/wellenreiter/libwellenreiter/source/wl_proto.cc | |||
@@ -9,7 +9,7 @@ | |||
9 | #include "wl_sock.hh" | 9 | #include "wl_sock.hh" |
10 | 10 | ||
11 | /* Adds a field to the buffer */ | 11 | /* Adds a field to the buffer */ |
12 | int add_field(char *buffer, char *string, int len) | 12 | int add_field(char *buffer, const char *string, int len) |
13 | { | 13 | { |
14 | char newlen[5]; | 14 | char newlen[5]; |
15 | 15 | ||
@@ -24,7 +24,7 @@ int add_field(char *buffer, char *string, int len) | |||
24 | return (atoi(newlen) + 3); | 24 | return (atoi(newlen) + 3); |
25 | } | 25 | } |
26 | 26 | ||
27 | int get_field(const char *buffer, char *out) | 27 | int get_field(const char *buffer, char *out, int maxlen) |
28 | { | 28 | { |
29 | char len[5]; | 29 | char len[5]; |
30 | 30 | ||
@@ -32,8 +32,12 @@ int get_field(const char *buffer, char *out) | |||
32 | memcpy(len, buffer, 3); | 32 | memcpy(len, buffer, 3); |
33 | 33 | ||
34 | /* Copy buffer to out pointer */ | 34 | /* Copy buffer to out pointer */ |
35 | memset(out, 0, atoi(len) + 1); | 35 | memset(out, 0, maxlen); |
36 | memcpy(out, buffer + 3, atoi(len)); | 36 | |
37 | if(atoi(len)-3 > maxlen -1) | ||
38 | memcpy(out, buffer + 3, maxlen - 1); | ||
39 | else | ||
40 | memcpy(out, buffer + 3, atoi(len)); | ||
37 | 41 | ||
38 | /* Return length of whole field (including 3 byte length) */ | 42 | /* Return length of whole field (including 3 byte length) */ |
39 | return (atoi(len) + 3); | 43 | return (atoi(len) + 3); |
@@ -100,24 +104,24 @@ int get_network_found (void *structure, const char *buffer) | |||
100 | 104 | ||
101 | /* Get net type (accesspoint || ad-hoc || ...) */ | 105 | /* Get net type (accesspoint || ad-hoc || ...) */ |
102 | memset(temp, 0, sizeof(temp)); | 106 | memset(temp, 0, sizeof(temp)); |
103 | len += get_field(buffer + len, temp); | 107 | len += get_field(buffer + len, temp, sizeof(temp)); |
104 | ptr->net_type = atoi(temp); | 108 | ptr->net_type = atoi(temp); |
105 | 109 | ||
106 | /* Get channel */ | 110 | /* Get channel */ |
107 | memset(temp, 0, sizeof(temp)); | 111 | memset(temp, 0, sizeof(temp)); |
108 | len += get_field(buffer + len, temp); | 112 | len += get_field(buffer + len, temp, sizeof(temp)); |
109 | ptr->channel = atoi(temp); | 113 | ptr->channel = atoi(temp); |
110 | 114 | ||
111 | /* Set WEP y/n */ | 115 | /* Set WEP y/n */ |
112 | memset(temp, 0, sizeof(temp)); | 116 | memset(temp, 0, sizeof(temp)); |
113 | len += get_field(buffer + len, temp); | 117 | len += get_field(buffer + len, temp, sizeof(temp)); |
114 | ptr->wep = atoi(temp); | 118 | ptr->wep = atoi(temp); |
115 | 119 | ||
116 | /* Set MAC address */ | 120 | /* Set MAC address */ |
117 | len += get_field(buffer + len, ptr->mac); | 121 | len += get_field(buffer + len, ptr->mac, sizeof(ptr->mac)); |
118 | 122 | ||
119 | /* Set BSSID */ | 123 | /* Set BSSID */ |
120 | len += get_field(buffer + len, ptr->bssid); | 124 | len += get_field(buffer + len, ptr->bssid, sizeof(ptr->bssid)); |
121 | 125 | ||
122 | return 1; | 126 | return 1; |
123 | } | 127 | } |