diff options
author | Havoc Pennington <hp@redhat.com> | 2005-02-06 05:19:50 +0000 |
---|---|---|
committer | Havoc Pennington <hp@redhat.com> | 2005-02-06 05:19:50 +0000 |
commit | 96a47516321dea8c08e1ab15ac0102ce3c3ae3f1 (patch) | |
tree | e0288218038a701393727546fd275cb1377fdda4 /dbus/dbus-marshal-validate.c | |
parent | 8f04e1e01f51fa9bef564dbaf29be59694407d21 (diff) | |
download | dbus-96a47516321dea8c08e1ab15ac0102ce3c3ae3f1.tar.gz |
2005-02-06 Havoc Pennington <hp@redhat.com>
* dbus/dbus-message-factory.c (generate_special): more tests
* dbus/dbus-marshal-validate.c (validate_body_helper): detect
array length that exceeds the maximum
Diffstat (limited to 'dbus/dbus-marshal-validate.c')
-rw-r--r-- | dbus/dbus-marshal-validate.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/dbus/dbus-marshal-validate.c b/dbus/dbus-marshal-validate.c index c1d95820..1639fb83 100644 --- a/dbus/dbus-marshal-validate.c +++ b/dbus/dbus-marshal-validate.c @@ -266,7 +266,7 @@ validate_body_helper (DBusTypeReader *reader, } if (claimed_len > (unsigned long) (end - p)) - return DBUS_INVALID_STRING_LENGTH_OUT_OF_BOUNDS; + return DBUS_INVALID_LENGTH_OUT_OF_BOUNDS; if (current_type == DBUS_TYPE_OBJECT_PATH) { @@ -294,6 +294,9 @@ validate_body_helper (DBusTypeReader *reader, DBusValidity validity; const unsigned char *array_end; + if (claimed_len > DBUS_MAXIMUM_ARRAY_LENGTH) + return DBUS_INVALID_ARRAY_LENGTH_EXCEEDS_MAXIMUM; + /* Remember that the reader is types only, so we can't * use it to iterate over elements. It stays the same * for all elements. |