Skip to content

Unsafe code in Network messages #2009

@xezon

Description

@xezon

Unsafe code in Network messages

UnsignedInt dataLength = 0;
memcpy(&dataLength, data + i, sizeof(dataLength)); // safe, but...
i += sizeof(dataLength);

UnsignedByte *buf = NEW UnsignedByte[dataLength]; // CRASH, if sender gives us a dataLength of 2 GB.
memcpy(buf, data + i, dataLength);
i += dataLength;

Metadata

Metadata

Assignees

Labels

MajorSeverity: Minor < Major < Critical < BlockerNetworkAnything related to network, serversSecurityIs security related

Type

No type

Projects

No projects

Relationships

None yet

Development

No branches or pull requests

Issue actions