From: wessels <>
Date: Tue, 5 Oct 1999 01:09:54 +0000 (+0000)
Subject: more checks on swap meta TLV values
X-Git-Tag: SQUID_3_0_PRE1~2115
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=fff97a60d6b3cc21d9ba993b1e63a1c64bdda184;p=thirdparty%2Fsquid.git

more checks on swap meta TLV values
---

diff --git a/src/store_swapmeta.cc b/src/store_swapmeta.cc
index d2aabd9534..305e7865e1 100644
--- a/src/store_swapmeta.cc
+++ b/src/store_swapmeta.cc
@@ -1,6 +1,6 @@
 
 /*
- * $Id: store_swapmeta.cc,v 1.7 1998/07/22 20:54:04 wessels Exp $
+ * $Id: store_swapmeta.cc,v 1.8 1999/10/04 19:09:54 wessels Exp $
  *
  * DEBUG: section 20    Storage Manager Swapfile Metadata
  * AUTHOR: Kostas Anagnostakis
@@ -126,7 +126,15 @@ storeSwapMetaUnpack(const char *buf, int *hdr_len)
     assert(buflen > (sizeof(char) + sizeof(int)));
     while (buflen - j > (sizeof(char) + sizeof(int))) {
 	type = buf[j++];
+	if (type < STORE_META_VOID || type > STORE_META_END) {
+	    debug(20, 0) ("storeSwapMetaUnpack: bad type (%d)!\n", type);
+	    break;
+	}
 	xmemcpy(&length, &buf[j], sizeof(int));
+	if (length < 0 || length > (1 << 10)) {
+	    debug(20, 0) ("storeSwapMetaUnpack: insane length (%d)!\n", length);
+	    break;
+	}
 	j += sizeof(int);
 	if (j + length > buflen) {
 	    debug(20, 0) ("storeSwapMetaUnpack: overflow!\n");