Merge branch 'dev' of https://github.com/ntop/nDPI into dev

4 files changed, 9 insertions, 5 deletions

diff --git a/src/lib/protocols/http.c b/src/lib/protocols/http.c
index 4382879d0..70ca0c389 100644
--- a/src/lib/protocols/http.c
+++ b/src/lib/protocols/http.c
@@ -484,7 +484,7 @@ static u_int16_t http_request_url_offset(struct ndpi_detection_module_struct *nd
 		packet->payload_packet_len);
 
   /* Check first char */
-  if(!strchr(http_fs,packet->payload[0])) return 0;
+  if(!packet->payload_packet_len || !strchr(http_fs,packet->payload[0])) return 0;
   /**
      FIRST PAYLOAD PACKET FROM CLIENT
   **/
diff --git a/src/lib/protocols/irc.c b/src/lib/protocols/irc.c
index 5ae0e34f7..37cfbe1ed 100644
--- a/src/lib/protocols/irc.c
+++ b/src/lib/protocols/irc.c
@@ -495,7 +495,7 @@ void ndpi_search_irc_tcp(struct ndpi_detection_module_struct *ndpi_struct, struc
 	  packet->parsed_lines = 0;
 	}
 	for (i = 0; i < packet->parsed_lines; i++) {
-	  if (packet->line[i].ptr[0] == ':') {
+	  if ((packet->line[i].len > 0) && packet->line[i].ptr[0] == ':') {
 	    flow->l4.tcp.irc_3a_counter++;
 	    if (flow->l4.tcp.irc_3a_counter == 7) {	/* ':' == 0x3a */
 	      NDPI_LOG_INFO(ndpi_struct, "found irc. 0x3a. seven times.");
diff --git a/src/lib/protocols/ssh.c b/src/lib/protocols/ssh.c
index 5bdf78959..068d2c345 100644
--- a/src/lib/protocols/ssh.c
+++ b/src/lib/protocols/ssh.c
@@ -296,7 +296,7 @@ static void ndpi_search_ssh_tcp(struct ndpi_detection_module_struct *ndpi_struct
       flow->l4.tcp.ssh_stage = 3;
       return;
     }
-  } else {
+  } else if(packet->payload_packet_len > 5) {
     u_int8_t msgcode = *(packet->payload + 5);
     ndpi_MD5_CTX ctx;
 
diff --git a/src/lib/protocols/tls.c b/src/lib/protocols/tls.c
index 23c47d7cd..ed92814d9 100644
--- a/src/lib/protocols/tls.c
+++ b/src/lib/protocols/tls.c
@@ -308,7 +308,11 @@ int getTLScertificate(struct ndpi_detection_module_struct *ndpi_struct,
 #endif
 
 	  offset += 2 + 1;
-	  extension_len = ntohs(*((u_int16_t*)&packet->payload[offset]));
+
+	  if((offset + 1) < packet->payload_packet_len) /* +1 because we are goint to read 2 bytes */
+	    extension_len = ntohs(*((u_int16_t*)&packet->payload[offset]));
+	  else
+	    extension_len = 0;
 
 #ifdef DEBUG_TLS
 	  printf("TLS [server][extension_len: %u]\n", extension_len);
@@ -870,7 +874,7 @@ int getSSCertificateFingerprint(struct ndpi_detection_module_struct *ndpi_struct
       return(0); /* That's all */
   } else if(flow->l4.tcp.tls_seen_certificate)
     return(0); /* That's all */  
-  else if(packet->payload_packet_len > flow->l4.tcp.tls_record_offset+7) {
+  else if(packet->payload_packet_len > flow->l4.tcp.tls_record_offset+7+1/* +1 because we are going to read 2 bytes */) {
     /* This is a handshake but not a certificate record */
     u_int16_t len = ntohs(*(u_int16_t*)&packet->payload[flow->l4.tcp.tls_record_offset+7]);