fix possible buffer overrun
authorSchanzenbach, Martin <martin.schanzenbach@aisec.fraunhofer.de>
Sun, 24 Jun 2018 21:01:18 +0000 (23:01 +0200)
committerSchanzenbach, Martin <martin.schanzenbach@aisec.fraunhofer.de>
Sun, 24 Jun 2018 21:01:18 +0000 (23:01 +0200)
src/namecache/namecache_api.c

index 2bb233da1932fb44bf4e5e01fd0617773d3a10a4..6e4ebeae0ff05330ea27b96fa103eeb08396a5b6 100644 (file)
@@ -224,6 +224,12 @@ handle_lookup_block_response (void *cls,
     GNUNET_free (qe);
     return;
   }
+  if (ntohs (msg->gns_header.header.size) < sizeof (struct LookupBlockResponseMessage))
+  {
+    LOG (GNUNET_ERROR_TYPE_ERROR,
+         "Message is too short\n");
+    return;
+  }
   size = ntohs (msg->gns_header.header.size)
     - sizeof (struct LookupBlockResponseMessage);
   {