3pp-mirror/snapcast
1
0
Fork 0
mirror of https://github.com/badaix/snapcast.git synced 2025-05-15 01:56:40 +02:00
Code Issues Projects Releases Packages Wiki Activity

fix crash when a malformed message is received

Browse source
This commit is contained in:
badaix 2017-10-10 19:29:58 +02:00
parent 50381bacaf
commit 08d39564e8
2 changed files with 16 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

5
message/message.h
View file

@ -56,7 +56,10 @@ enum message_type
kWireChunk = 2, kWireChunk = 2,
kServerSettings = 3, kServerSettings = 3,
kTime = 4, kTime = 4,
kHello = 5 kHello = 5,
kFirst = kBase,
kLast = kHello
}; };

16
server/streamSession.cpp
View file

@ -181,12 +181,20 @@ void StreamSession::getNextMessage()
vector<char> buffer(baseMsgSize); vector<char> buffer(baseMsgSize);
socketRead(&buffer[0], baseMsgSize); socketRead(&buffer[0], baseMsgSize);
baseMessage.deserialize(&buffer[0]); baseMessage.deserialize(&buffer[0]);
if (baseMessage.size > msg::max_size)
if ((baseMessage.type > message_type::kLast) || (baseMessage.type < message_type::kFirst))
{ {
SLOG(ERROR) << "received message of type " << baseMessage.type << " to large: " << baseMessage.size << "\n"; stringstream ss;
stop(); ss << "unknown message type received: " << baseMessage.type << ", size: " << baseMessage.size;
return; throw std::runtime_error(ss.str().c_str());
} }
else if (baseMessage.size > msg::max_size)
{
stringstream ss;
ss << "received message of type " << baseMessage.type << " to large: " << baseMessage.size;
throw std::runtime_error(ss.str().c_str());
}
// LOG(INFO) << "getNextMessage: " << baseMessage.type << ", size: " << baseMessage.size << ", id: " << baseMessage.id << ", refers: " << baseMessage.refersTo << "\n"; // LOG(INFO) << "getNextMessage: " << baseMessage.type << ", size: " << baseMessage.size << ", id: " << baseMessage.id << ", refers: " << baseMessage.refersTo << "\n";
if (baseMessage.size > buffer.size()) if (baseMessage.size > buffer.size())
buffer.resize(baseMessage.size); buffer.resize(baseMessage.size);