diff options
| author | Luca Deri <lucaderi@users.noreply.github.com> | 2018-07-25 08:17:32 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2018-07-25 08:17:32 +0200 |
| commit | 6474125c93aaf36f5f0f489088f7064941327fa2 (patch) | |
| tree | 36cf481c28005ba7c4c2dd837c3a66a1bdb80914 | |
| parent | 5100cc0eaec27c9796bab749435972adf2f89246 (diff) | |
| parent | fbf6bd2be8cc6a8b1a091606e378698f7b6cdeac (diff) | |
Merge pull request #577 from eglooca/pr-parse-packet-line-info-length
Fix end-of-line bounds handling.
| -rw-r--r-- | src/lib/ndpi_main.c | 8 |
1 files changed, 3 insertions, 5 deletions
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c index 03c7e91cf..13c89424e 100644 --- a/src/lib/ndpi_main.c +++ b/src/lib/ndpi_main.c @@ -4484,7 +4484,6 @@ void ndpi_parse_packet_line_info(struct ndpi_detection_module_struct *ndpi_struc { u_int32_t a; struct ndpi_packet_struct *packet = &flow->packet; - u_int16_t end = packet->payload_packet_len - 1; if(packet->packet_lines_parsed_complete != 0) return; @@ -4525,15 +4524,14 @@ void ndpi_parse_packet_line_info(struct ndpi_detection_module_struct *ndpi_struc packet->http_response.len = 0; packet->http_num_headers=0; - if((packet->payload_packet_len == 0) - || (packet->payload == NULL) - || (end == 0)) + if((packet->payload_packet_len < 3) + || (packet->payload == NULL)) return; packet->line[packet->parsed_lines].ptr = packet->payload; packet->line[packet->parsed_lines].len = 0; - for(a = 0; a < end-1 /* This because get_u_int16_t(packet->payload, a) reads 2 bytes */; a++) { + for(a = 0; a < packet->payload_packet_len; a++) { if(get_u_int16_t(packet->payload, a) == ntohs(0x0d0a)) { /* If end of line char sequence CR+NL "\r\n", process line */ packet->line[packet->parsed_lines].len = (u_int16_t)(((unsigned long) &packet->payload[a]) - ((unsigned long) packet->line[packet->parsed_lines].ptr)); |