Commit deed2a60 authored by Max Lv's avatar Max Lv

fix potential buffer overflow

parent d897e884
No preview for this file type
...@@ -16,6 +16,7 @@ ...@@ -16,6 +16,7 @@
#include <strings.h> #include <strings.h>
#include <time.h> #include <time.h>
#include <unistd.h> #include <unistd.h>
#include <assert.h>
#include <linux/limits.h> #include <linux/limits.h>
#include "local.h" #include "local.h"
...@@ -23,14 +24,8 @@ ...@@ -23,14 +24,8 @@
#include "encrypt.h" #include "encrypt.h"
#include "android.h" #include "android.h"
#define REPLY "HTTP/1.1 200 OK\n\nhello"
#define min(a,b) (((a)<(b))?(a):(b)) #define min(a,b) (((a)<(b))?(a):(b))
// every watcher type has its own typedef'd struct
// with the name ev_TYPE
ev_io stdin_watcher;
static char *_server; static char *_server;
static char *_remote_port; static char *_remote_port;
...@@ -147,12 +142,13 @@ static void server_recv_cb (EV_P_ ev_io *w, int revents) { ...@@ -147,12 +142,13 @@ static void server_recv_cb (EV_P_ ev_io *w, int revents) {
} }
} else if(w < r) { } else if(w < r) {
char *pt = remote->buf; char *pt = remote->buf;
char *et = pt + min(w, BUF_SIZE); char *et = pt + r;
while (pt < et) { while (pt + w < et) {
*pt = *(pt + w); *pt = *(pt + w);
pt++; pt++;
} }
remote->buf_len = r - w; remote->buf_len = r - w;
assert(remote->buf_len >= 0);
ev_io_stop(EV_A_ &server_recv_ctx->io); ev_io_stop(EV_A_ &server_recv_ctx->io);
ev_io_start(EV_A_ &remote->send_ctx->io); ev_io_start(EV_A_ &remote->send_ctx->io);
break; break;
...@@ -270,12 +266,13 @@ static void server_send_cb (EV_P_ ev_io *w, int revents) { ...@@ -270,12 +266,13 @@ static void server_send_cb (EV_P_ ev_io *w, int revents) {
if (r < server->buf_len) { if (r < server->buf_len) {
// partly sent, move memory, wait for the next time to send // partly sent, move memory, wait for the next time to send
char *pt = server->buf; char *pt = server->buf;
char *et = pt + min(r, BUF_SIZE); char *et = pt + server->buf_len;
while (pt < et) { while (pt + r < et) {
*pt = *(pt + r); *pt = *(pt + r);
pt++; pt++;
} }
server->buf_len -= r; server->buf_len -= r;
assert(server->buf_len >= 0);
return; return;
} else { } else {
// all sent out, wait for reading // all sent out, wait for reading
...@@ -339,12 +336,13 @@ static void remote_recv_cb (EV_P_ ev_io *w, int revents) { ...@@ -339,12 +336,13 @@ static void remote_recv_cb (EV_P_ ev_io *w, int revents) {
} }
} else if(w < r) { } else if(w < r) {
char *pt = server->buf; char *pt = server->buf;
char *et = pt + min(w, BUF_SIZE); char *et = pt + r;
while (pt < et) { while (pt + w < et) {
*pt = *(pt + w); *pt = *(pt + w);
pt++; pt++;
} }
server->buf_len = r - w; server->buf_len = r - w;
assert(server->buf_len >= 0);
ev_io_stop(EV_A_ &remote_recv_ctx->io); ev_io_stop(EV_A_ &remote_recv_ctx->io);
ev_io_start(EV_A_ &server->send_ctx->io); ev_io_start(EV_A_ &server->send_ctx->io);
break; break;
...@@ -398,12 +396,13 @@ static void remote_send_cb (EV_P_ ev_io *w, int revents) { ...@@ -398,12 +396,13 @@ static void remote_send_cb (EV_P_ ev_io *w, int revents) {
if (r < remote->buf_len) { if (r < remote->buf_len) {
// partly sent, move memory, wait for the next time to send // partly sent, move memory, wait for the next time to send
char *pt = remote->buf; char *pt = remote->buf;
char *et = pt + min(r, BUF_SIZE); char *et = pt + remote->buf_len;
while (pt < et) { while (pt + r < et) {
*pt = *(pt + r); *pt = *(pt + r);
pt++; pt++;
} }
remote->buf_len -= r; remote->buf_len -= r;
assert(remote->buf_len >= 0);
return; return;
} else { } else {
// all sent out, wait for reading // all sent out, wait for reading
......
No preview for this file type
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment