e5af3468d8
OBS-URL: https://build.opensuse.org/package/show/network:utilities/openslp?expand=0&rev=052ac759f139234c41238b1ece1ecbe8
23 lines
810 B
Diff
23 lines
810 B
Diff
--- ./common/slp_message.c.orig 2010-10-12 15:42:23.439823000 +0000
|
|
+++ ./common/slp_message.c 2010-10-12 15:45:44.936750000 +0000
|
|
@@ -872,10 +872,19 @@ int ParseExtension(SLPBuffer buffer, SLP
|
|
int extid;
|
|
int nextoffset;
|
|
int result = SLP_ERROR_OK;
|
|
+ int bufsz = (int)(buffer->end - buffer->start);
|
|
|
|
nextoffset = message->header.extoffset;
|
|
while(nextoffset)
|
|
{
|
|
+ /* check for circular reference in list
|
|
+ * if the size gets below zero, we know we're
|
|
+ * reprocessing extensions in a loop.
|
|
+ */
|
|
+ bufsz -= 5;
|
|
+ if (bufsz <= 0)
|
|
+ return SLP_ERROR_PARSE_ERROR;
|
|
+
|
|
buffer->curpos = buffer->start + nextoffset;
|
|
if(buffer->curpos + 5 >= buffer->end)
|
|
{
|