Skip to content
Snippets Groups Projects
Commit e44ecbcd authored by Arne Goedeke's avatar Arne Goedeke
Browse files

BSON: insufficient out of bounds check

parent b7674d97
No related branches found
No related tags found
No related merge requests found
...@@ -231,7 +231,7 @@ char * decode_next_value(struct pike_string * pike_slist, char * n, struct mappi ...@@ -231,7 +231,7 @@ char * decode_next_value(struct pike_string * pike_slist, char * n, struct mappi
bump = get_unaligned_le32(n); bump = get_unaligned_le32(n);
left = pike_slist->len - (n - slist); left = pike_slist->len - (n - slist);
if(!bump || bump > left) if(bump <= 0 || bump > left)
{ {
Pike_error("invalid BSON. not enough data: need %d, have %d.\n", bump, left); Pike_error("invalid BSON. not enough data: need %d, have %d.\n", bump, left);
} }
...@@ -251,7 +251,7 @@ char * decode_next_value(struct pike_string * pike_slist, char * n, struct mappi ...@@ -251,7 +251,7 @@ char * decode_next_value(struct pike_string * pike_slist, char * n, struct mappi
n+=4; n+=4;
left = pike_slist->len - (n - slist); left = pike_slist->len - (n - slist);
if(!bump || bump > left) if(bump <= 0 || bump > left)
{ {
Pike_error("invalid BSON. not enough data 5.\n"); Pike_error("invalid BSON. not enough data 5.\n");
} }
...@@ -510,7 +510,7 @@ char * decode_next_value(struct pike_string * pike_slist, char * n, struct mappi ...@@ -510,7 +510,7 @@ char * decode_next_value(struct pike_string * pike_slist, char * n, struct mappi
int32_t left; int32_t left;
n+=4; n+=4;
left = pike_slist->len - (n - slist); left = pike_slist->len - (n - slist);
if(!bump || bump > left) if(bump <= 0 || bump > left)
Pike_error("invalid BSON. not enough data.\n"); Pike_error("invalid BSON. not enough data.\n");
val = make_shared_binary_string(n, bump-1); // length includes null. val = make_shared_binary_string(n, bump-1); // length includes null.
n += (bump); n += (bump);
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment