more checks on swap meta TLV values

diff --git a/src/store_swapmeta.cc b/src/store_swapmeta.cc
index d2aabd9534d3e424c56fdfd73267248ac8417c5d..305e7865e14c16534afdf0dc817624874ba4e34a 100644 (file)
--- a/src/store_swapmeta.cc
+++ b/src/store_swapmeta.cc
@@ -1,6 +1,6 @@
 
 /*
- * $Id: store_swapmeta.cc,v 1.7 1998/07/22 20:54:04 wessels Exp $
+ * $Id: store_swapmeta.cc,v 1.8 1999/10/04 19:09:54 wessels Exp $
  *
  * DEBUG: section 20    Storage Manager Swapfile Metadata
  * AUTHOR: Kostas Anagnostakis
@@ -126,7 +126,15 @@ storeSwapMetaUnpack(const char *buf, int *hdr_len)
     assert(buflen > (sizeof(char) + sizeof(int)));
     while (buflen - j > (sizeof(char) + sizeof(int))) {
        type = buf[j++];
+       if (type < STORE_META_VOID || type > STORE_META_END) {
+           debug(20, 0) ("storeSwapMetaUnpack: bad type (%d)!\n", type);
+           break;
+       }
        xmemcpy(&length, &buf[j], sizeof(int));
+       if (length < 0 || length > (1 << 10)) {
+           debug(20, 0) ("storeSwapMetaUnpack: insane length (%d)!\n", length);
+           break;
+       }
        j += sizeof(int);
        if (j + length > buflen) {
            debug(20, 0) ("storeSwapMetaUnpack: overflow!\n");