From: Rafał Miłecki <zajec5@gmail.com>
Date: Tue, 14 Apr 2015 12:18:57 +0000 (+0000)
Subject: otrx: check TRX length read from header to avoid Segmentation fault
X-Git-Url: http://git.lede-project.org./?a=commitdiff_plain;h=834e60c4f16b3131c9dd51a0bc00bd47222f57a6;p=openwrt%2Fstaging%2Fnbd.git

otrx: check TRX length read from header to avoid Segmentation fault

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>

SVN-Revision: 45433
---

diff --git a/package/utils/otrx/src/otrx.c b/package/utils/otrx/src/otrx.c
index a2bc29f59a..7fe4ba6f69 100644
--- a/package/utils/otrx/src/otrx.c
+++ b/package/utils/otrx/src/otrx.c
@@ -167,6 +167,12 @@ static int otrx_check() {
 	}
 
 	length = le32_to_cpu(hdr.length);
+	if (length < sizeof(hdr)) {
+		fprintf(stderr, "Length read from TRX too low (%zu B)\n", length);
+		err = -EINVAL;
+		goto err_close;
+	}
+
 	buf = malloc(length);
 	if (!buf) {
 		fprintf(stderr, "Couldn't alloc %d B buffer\n", length);