Merge branch 'dev' of https://github.com/ntop/nDPI into dev

6 files changed, 14 insertions, 8 deletions

diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index a2a7e593d..1efa9fd2f 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -4252,6 +4252,8 @@ ndpi_protocol ndpi_detection_giveup(struct ndpi_detection_module_struct *ndpi_st
 	if(flow->host_server_name[0] != '\0') {
 	  ndpi_protocol_match_result ret_match;
 
+	  memset(&ret_match, 0, sizeof(ret_match));
+
 	  ndpi_match_host_subprotocol(ndpi_str, flow,
 				      (char *)flow->host_server_name,
 				      strlen((const char*)flow->host_server_name),
@@ -4700,7 +4702,7 @@ ndpi_protocol ndpi_detection_process_packet(struct ndpi_detection_module_struct
       ndpi_process_extra_packet(ndpi_str, flow, packet, packetlen, current_tick_l, src, dst);
       /* Update in case of new match */
       ret.master_protocol = flow->detected_protocol_stack[1], ret.app_protocol = flow->detected_protocol_stack[0], ret.category = flow->category;;
-      return(ret);
+      goto invalidate_ptr;
     } else
       goto ret_protocols;
   }
@@ -5096,7 +5098,7 @@ void ndpi_parse_packet_line_info(struct ndpi_detection_module_struct *ndpi_str,
 
   for(a = 0; (a < packet->payload_packet_len)
 	&& (packet->parsed_lines < NDPI_MAX_PARSE_LINES_PER_PACKET); a++) {
-    if((a + 1) == packet->payload_packet_len)
+    if((a + 1) >= packet->payload_packet_len)
       return; /* Return if only one byte remains (prevent invalid reads past end-of-buffer) */
 
     if(get_u_int16_t(packet->payload, a) == ntohs(0x0d0a)) { /* If end of line char sequence CR+NL "\r\n", process line */
diff --git a/src/lib/ndpi_serializer.c b/src/lib/ndpi_serializer.c
index baacfd403..36ff154d2 100644
--- a/src/lib/ndpi_serializer.c
+++ b/src/lib/ndpi_serializer.c
@@ -200,7 +200,7 @@ char* ndpi_serializer_get_buffer(ndpi_serializer *_serializer, u_int32_t *buffer
   *buffer_len = serializer->status.size_used;
 
   if(serializer->fmt == ndpi_serialization_format_json) {
-    while(buf[0] == '\0')
+    while((buf[0] == '\0') || (buf[0] == ' '))
       buf++, *buffer_len = *buffer_len - 1;
   }
 
diff --git a/src/lib/protocols/http.c b/src/lib/protocols/http.c
index 4382879d0..70ca0c389 100644
--- a/src/lib/protocols/http.c
+++ b/src/lib/protocols/http.c
@@ -484,7 +484,7 @@ static u_int16_t http_request_url_offset(struct ndpi_detection_module_struct *nd
 		packet->payload_packet_len);
 
   /* Check first char */
-  if(!strchr(http_fs,packet->payload[0])) return 0;
+  if(!packet->payload_packet_len || !strchr(http_fs,packet->payload[0])) return 0;
   /**
      FIRST PAYLOAD PACKET FROM CLIENT
   **/
diff --git a/src/lib/protocols/irc.c b/src/lib/protocols/irc.c
index 5ae0e34f7..37cfbe1ed 100644
--- a/src/lib/protocols/irc.c
+++ b/src/lib/protocols/irc.c
@@ -495,7 +495,7 @@ void ndpi_search_irc_tcp(struct ndpi_detection_module_struct *ndpi_struct, struc
 	  packet->parsed_lines = 0;
 	}
 	for (i = 0; i < packet->parsed_lines; i++) {
-	  if (packet->line[i].ptr[0] == ':') {
+	  if ((packet->line[i].len > 0) && packet->line[i].ptr[0] == ':') {
 	    flow->l4.tcp.irc_3a_counter++;
 	    if (flow->l4.tcp.irc_3a_counter == 7) {	/* ':' == 0x3a */
 	      NDPI_LOG_INFO(ndpi_struct, "found irc. 0x3a. seven times.");
diff --git a/src/lib/protocols/ssh.c b/src/lib/protocols/ssh.c
index 5bdf78959..068d2c345 100644
--- a/src/lib/protocols/ssh.c
+++ b/src/lib/protocols/ssh.c
@@ -296,7 +296,7 @@ static void ndpi_search_ssh_tcp(struct ndpi_detection_module_struct *ndpi_struct
       flow->l4.tcp.ssh_stage = 3;
       return;
     }
-  } else {
+  } else if(packet->payload_packet_len > 5) {
     u_int8_t msgcode = *(packet->payload + 5);
     ndpi_MD5_CTX ctx;
 
diff --git a/src/lib/protocols/tls.c b/src/lib/protocols/tls.c
index 23c47d7cd..ed92814d9 100644
--- a/src/lib/protocols/tls.c
+++ b/src/lib/protocols/tls.c
@@ -308,7 +308,11 @@ int getTLScertificate(struct ndpi_detection_module_struct *ndpi_struct,
 #endif
 
 	  offset += 2 + 1;
-	  extension_len = ntohs(*((u_int16_t*)&packet->payload[offset]));
+
+	  if((offset + 1) < packet->payload_packet_len) /* +1 because we are goint to read 2 bytes */
+	    extension_len = ntohs(*((u_int16_t*)&packet->payload[offset]));
+	  else
+	    extension_len = 0;
 
 #ifdef DEBUG_TLS
 	  printf("TLS [server][extension_len: %u]\n", extension_len);
@@ -870,7 +874,7 @@ int getSSCertificateFingerprint(struct ndpi_detection_module_struct *ndpi_struct
       return(0); /* That's all */
   } else if(flow->l4.tcp.tls_seen_certificate)
     return(0); /* That's all */  
-  else if(packet->payload_packet_len > flow->l4.tcp.tls_record_offset+7) {
+  else if(packet->payload_packet_len > flow->l4.tcp.tls_record_offset+7+1/* +1 because we are going to read 2 bytes */) {
     /* This is a handshake but not a certificate record */
     u_int16_t len = ntohs(*(u_int16_t*)&packet->payload[flow->l4.tcp.tls_record_offset+7]);