otrx: check TRX length read from header to avoid Segmentation fault
authorRafał Miłecki <zajec5@gmail.com>
Tue, 14 Apr 2015 12:18:57 +0000 (12:18 +0000)
committerRafał Miłecki <zajec5@gmail.com>
Tue, 14 Apr 2015 12:18:57 +0000 (12:18 +0000)
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
SVN-Revision: 45433

package/utils/otrx/src/otrx.c

index a2bc29f..7fe4ba6 100644 (file)
@@ -167,6 +167,12 @@ static int otrx_check() {
        }
 
        length = le32_to_cpu(hdr.length);
+       if (length < sizeof(hdr)) {
+               fprintf(stderr, "Length read from TRX too low (%zu B)\n", length);
+               err = -EINVAL;
+               goto err_close;
+       }
+
        buf = malloc(length);
        if (!buf) {
                fprintf(stderr, "Couldn't alloc %d B buffer\n", length);