Fabio Alessandrelli
5262d1bbcc
Fix marshalls size checks.
...
Yesterday, when playing around with my network code, I realized there is
a security issue in decode_variant, at least when decoding PoolArrays.
Basically, the size of the PoolArray is encoded in a uint32_t, when
decoding it, that value is cast to int when comparing if the packet is
actually that size causing numbers with MSB=1 to be interpreted as
negative thus always passing the check. That same value though, is used
as uint32_t again to resize the output vector. For this reason, sending
a malformed packet with declared type PoolByteArray and size of 2^31(+x)
causes the engine to try to allocate 2+GB of pool memory, causing the
engine to crash.
2018-07-28 21:21:19 +02:00
..
2018-06-05 21:42:33 +02:00
2018-01-05 01:22:23 +01:00
2018-07-28 21:21:19 +02:00
2018-06-01 18:08:29 +02:00
2018-06-13 11:57:40 +00:00
2018-01-05 01:22:23 +01:00
2018-01-05 01:22:23 +01:00
2018-01-05 01:22:23 +01:00
2018-04-29 20:44:48 +02:00
2018-02-19 22:13:44 +01:00
2017-01-15 12:51:47 +01:00
2018-01-16 10:22:22 +01:00
2018-01-12 00:08:32 -03:00
2018-01-05 01:22:23 +01:00
2018-03-01 21:06:31 +01:00
2018-01-05 01:22:23 +01:00
2018-02-22 12:17:06 +01:00
2018-01-05 01:22:23 +01:00
2018-01-05 01:22:23 +01:00
2018-07-28 16:06:30 +02:00
2018-07-28 16:06:30 +02:00
2018-01-05 01:22:23 +01:00
2018-07-18 16:37:23 +02:00
2018-01-05 01:22:23 +01:00
2018-01-05 01:22:23 +01:00
2018-01-05 01:22:23 +01:00
2018-01-05 01:22:23 +01:00
2018-02-22 12:17:06 +01:00
2018-01-05 01:22:23 +01:00
2018-01-05 01:22:23 +01:00
2018-02-22 12:17:06 +01:00
2018-01-05 01:22:23 +01:00
2018-01-05 01:22:23 +01:00
2018-01-05 01:22:23 +01:00
2018-05-13 21:59:22 +02:00
2018-01-05 01:22:23 +01:00
2018-01-05 01:22:23 +01:00
2018-01-05 01:22:23 +01:00
2018-01-01 14:40:47 +01:00
2018-01-18 22:01:42 +01:00
2018-02-19 22:13:44 +01:00
2018-02-22 12:17:06 +01:00
2018-02-22 12:17:06 +01:00
2018-01-05 01:22:23 +01:00
2018-01-05 01:22:23 +01:00
2018-01-18 22:01:42 +01:00
2018-01-05 01:22:23 +01:00
2018-01-05 01:22:23 +01:00
2018-01-05 01:22:23 +01:00
2018-01-18 22:01:42 +01:00
2018-01-12 00:58:14 +02:00
2018-01-15 22:19:54 +01:00
2018-01-05 01:22:23 +01:00
2018-01-05 01:22:23 +01:00
2018-01-05 01:22:23 +01:00
2018-01-05 01:22:23 +01:00
2018-01-05 01:22:23 +01:00
2018-01-05 01:22:23 +01:00
2018-02-22 12:17:06 +01:00
2018-01-05 01:22:23 +01:00
2018-01-05 01:22:23 +01:00
2018-01-05 01:22:23 +01:00
2018-04-28 17:04:20 +02:00
2018-02-22 12:19:28 +01:00
2018-01-05 01:22:23 +01:00
2018-01-05 01:22:23 +01:00
2018-01-05 01:22:23 +01:00
2018-01-05 01:22:23 +01:00
2018-01-05 01:22:23 +01:00
2018-01-05 01:22:23 +01:00
2018-01-18 18:35:24 +01:00
2018-01-05 01:22:23 +01:00
2018-01-05 01:22:23 +01:00
2018-01-05 01:22:23 +01:00
2018-01-05 01:22:23 +01:00
2018-02-04 20:10:13 +01:00
2018-01-05 01:22:23 +01:00
2018-01-09 17:19:03 +01:00
2018-01-09 17:19:03 +01:00
2018-07-08 15:39:15 +02:00
2018-07-08 15:39:15 +02:00
2018-01-12 00:58:14 +02:00
2018-04-15 00:48:11 +02:00
2018-06-22 14:42:14 +02:00
2018-01-05 01:22:23 +01:00
2018-02-22 12:17:06 +01:00
2018-01-05 01:22:23 +01:00
2018-01-05 01:22:23 +01:00
2018-01-05 01:22:23 +01:00
2018-01-05 01:22:23 +01:00
2018-01-20 15:26:58 +01:00
2018-01-05 01:22:23 +01:00
2018-01-05 01:22:23 +01:00
2018-01-05 01:22:23 +01:00
2018-02-19 22:27:19 +01:00
2018-01-05 01:22:23 +01:00
2018-01-05 01:22:23 +01:00
2018-07-27 17:14:22 +02:00
2018-01-05 01:22:23 +01:00
2018-01-08 10:57:07 -06:00
2018-01-08 10:57:07 -06:00
2018-05-13 23:03:48 +02:00
2018-02-26 22:36:03 +01:00
2018-06-01 18:08:29 +02:00
2018-01-05 01:22:23 +01:00
2018-04-28 22:56:33 +02:00
2018-01-05 01:22:23 +01:00
2018-01-05 01:22:23 +01:00
2018-01-05 01:22:23 +01:00
2018-02-22 12:17:06 +01:00
2018-01-05 01:22:23 +01:00
2018-02-24 01:34:34 +01:00
2018-01-05 01:22:23 +01:00
2018-01-05 01:22:23 +01:00