Commit deed2a60 authored by Max Lv's avatar Max Lv

fix potential buffer overflow

parent d897e884
No preview for this file type
......@@ -16,6 +16,7 @@
#include <strings.h>
#include <time.h>
#include <unistd.h>
#include <assert.h>
#include <linux/limits.h>
#include "local.h"
......@@ -23,14 +24,8 @@
#include "encrypt.h"
#include "android.h"
#define REPLY "HTTP/1.1 200 OK\n\nhello"
#define min(a,b) (((a)<(b))?(a):(b))
// every watcher type has its own typedef'd struct
// with the name ev_TYPE
ev_io stdin_watcher;
static char *_server;
static char *_remote_port;
......@@ -147,12 +142,13 @@ static void server_recv_cb (EV_P_ ev_io *w, int revents) {
}
} else if(w < r) {
char *pt = remote->buf;
char *et = pt + min(w, BUF_SIZE);
while (pt < et) {
char *et = pt + r;
while (pt + w < et) {
*pt = *(pt + w);
pt++;
}
remote->buf_len = r - w;
assert(remote->buf_len >= 0);
ev_io_stop(EV_A_ &server_recv_ctx->io);
ev_io_start(EV_A_ &remote->send_ctx->io);
break;
......@@ -270,12 +266,13 @@ static void server_send_cb (EV_P_ ev_io *w, int revents) {
if (r < server->buf_len) {
// partly sent, move memory, wait for the next time to send
char *pt = server->buf;
char *et = pt + min(r, BUF_SIZE);
while (pt < et) {
char *et = pt + server->buf_len;
while (pt + r < et) {
*pt = *(pt + r);
pt++;
}
server->buf_len -= r;
assert(server->buf_len >= 0);
return;
} else {
// all sent out, wait for reading
......@@ -339,12 +336,13 @@ static void remote_recv_cb (EV_P_ ev_io *w, int revents) {
}
} else if(w < r) {
char *pt = server->buf;
char *et = pt + min(w, BUF_SIZE);
while (pt < et) {
char *et = pt + r;
while (pt + w < et) {
*pt = *(pt + w);
pt++;
}
server->buf_len = r - w;
assert(server->buf_len >= 0);
ev_io_stop(EV_A_ &remote_recv_ctx->io);
ev_io_start(EV_A_ &server->send_ctx->io);
break;
......@@ -398,12 +396,13 @@ static void remote_send_cb (EV_P_ ev_io *w, int revents) {
if (r < remote->buf_len) {
// partly sent, move memory, wait for the next time to send
char *pt = remote->buf;
char *et = pt + min(r, BUF_SIZE);
while (pt < et) {
char *et = pt + remote->buf_len;
while (pt + r < et) {
*pt = *(pt + r);
pt++;
}
remote->buf_len -= r;
assert(remote->buf_len >= 0);
return;
} else {
// all sent out, wait for reading
......
No preview for this file type
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment