From ec497cf529bbeed4e10023fb8ee95c42eb9956bd Mon Sep 17 00:00:00 2001 From: Howard Chu Date: Sun, 2 Mar 2003 04:02:39 +0000 Subject: [PATCH] Use fixed sizes for ber_get_next to avoid 64-bit hangs. --- libraries/liblber/io.c | 23 +++++++++++++++++------ 1 file changed, 17 insertions(+), 6 deletions(-) diff --git a/libraries/liblber/io.c b/libraries/liblber/io.c index 7dc2fa82b5..dbe7a73dde 100644 --- a/libraries/liblber/io.c +++ b/libraries/liblber/io.c @@ -456,6 +456,8 @@ ber_reset( BerElement *ber, int was_writing ) * a full packet is read. */ +#define LENSIZE 4 + ber_tag_t ber_get_next( Sockbuf *sb, @@ -486,6 +488,15 @@ ber_get_next( * 1) small tags (less than 128) * 2) definite lengths * 3) primitive encodings used whenever possible + * + * The code also handles multi-byte tags. The first few bytes + * of the message are read to check for multi-byte tags and + * lengths. These bytes are temporarily stored in the ber_tag, + * ber_len, and ber_usertag fields of the berelement until + * tag/len parsing is complete. After this parsing, any leftover + * bytes and the rest of the message are copied into the ber_buf. + * + * We expect tag and len to be at most 32 bits wide. */ if (ber->ber_rwptr == NULL) { @@ -499,13 +510,13 @@ ber_get_next( } while (ber->ber_rwptr > (char *)&ber->ber_tag && ber->ber_rwptr < - (char *)(&ber->ber_usertag + 1)) { + (char *)&ber->ber_len + LENSIZE*2) { ber_slen_t sblen; - char buf[sizeof(ber->ber_len)-1]; + char buf[LENSIZE-1]; ber_len_t tlen = 0; sblen=ber_int_sb_read( sb, ber->ber_rwptr, - (char *)(&ber->ber_usertag+1)-ber->ber_rwptr); + ((char *)&ber->ber_len + LENSIZE*2)-ber->ber_rwptr); if (sblen<=0) return LBER_DEFAULT; ber->ber_rwptr += sblen; @@ -563,11 +574,11 @@ ber_get_next( } /* Are there leftover data bytes inside ber->ber_len? */ - if (ber->ber_ptr < (char *)&ber->ber_usertag) { - if (ber->ber_rwptr < (char *)&ber->ber_usertag) + if (ber->ber_ptr < (char *)&ber->ber_len+LENSIZE) { + if (ber->ber_rwptr < (char *)&ber->ber_len+LENSIZE) sblen = ber->ber_rwptr - ber->ber_ptr; else - sblen = (char *)&ber->ber_usertag - ber->ber_ptr; + sblen = ((char *)&ber->ber_len+LENSIZE) - ber->ber_ptr; AC_MEMCPY(buf, ber->ber_ptr, sblen); ber->ber_ptr += sblen; } else { -- 2.39.5