Magic-Mirror/radare2
1
0
Fork 0
mirror of https://github.com/radareorg/radare2.git synced 2024-11-27 15:10:53 +00:00
Code Issues Actions 6 Packages Projects Releases Wiki Activity

Fix oobread transfering large packets via qnxr

Browse Source
This commit is contained in:
Sergi Àlvarez i Capilla 2022-01-09 21:41:25 +01:00
parent e60bc5d12c
commit 084064bdf1
2 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
shlr/qnx/src/core.c
View File

@ -151,7 +151,6 @@ int qnxr_connect(libqnxr_t *g, const char *host, int port) {
g->connected = 0; g->connected = 0;
g->mid = 0; g->mid = 0;
memmove (g->host, host, strlen (host) + 1); memmove (g->host, host, strlen (host) + 1);
g->port = port; g->port = port;

6
shlr/qnx/src/packet.c
View File

@ -1,4 +1,4 @@
/* libqnxr - GPL - Copyright 2014-2016 - defragger, madprogrammer */ /* libqnxr - GPL - Copyright 2014-2022 - pancake, defragger, madprogrammer */
#include <errno.h> #include <errno.h>
#include "packet.h" #include "packet.h"
@ -155,6 +155,10 @@ int qnxr_send_packet (libqnxr_t *g) {
p = g->send_buff; p = g->send_buff;
*p++ = FRAME_CHAR; *p++ = FRAME_CHAR;
if (g->send_len >= sizeof (g->tran.data)) {
eprintf ("Too large packet %d vs %d\n", (int)g->send_len, (int)sizeof (g->send_len));
return false;
}
for (i = 0; i < g->send_len; i++) { for (i = 0; i < g->send_len; i++) {
ut8 c = g->tran.data[i]; ut8 c = g->tran.data[i];
csum += c; csum += c;