Context Navigation

Timeline

4:47 AM Ticket #2432 (spudec_process_control can read beyond the end of a packet, now with fix!) updated by wififreedom: I see, it's safer to write it that way. It would be good to have some …

11:09 PM Ticket #2432 (spudec_process_control can read beyond the end of a packet, now with fix!) updated by beastd: In general I'm not really satisfied with the whole spudec.c …
7:03 AM Ticket #2432 (spudec_process_control can read beyond the end of a packet, now with fix!) updated by wififreedom: I've done a quick review: I'm looking at the code and find it hard to …

9:58 PM Ticket #2432 (spudec_process_control can read beyond the end of a packet, now with fix!) updated by wififreedom: I've seen this, will check tomorrow at the earliest.
9:12 PM Ticket #2432 (spudec_process_control can read beyond the end of a packet, now with fix!) updated by beastd: I have attached a patch ( …
8:46 PM v1-0001-WIP-XXX-spudec_process_control-Don-t-read-beyond-.patch attached to Ticket #2432 by beastd

7:24 PM Ticket #2432 (spudec_process_control can read beyond the end of a packet, now with fix!) updated by wififreedom: I still have the data, so testing patches shouldn't be a problem.
4:36 AM Ticket #2432 (spudec_process_control can read beyond the end of a packet, now with fix!) updated by beastd: Replying to wififreedom: > ... and, of course, …

12:49 AM Ticket #2432 (spudec_process_control can read beyond the end of a packet, now with fix!) updated by wififreedom: ... and, of course, spudec_process_control should be made safer to …
12:47 AM Ticket #2432 (spudec_process_control can read beyond the end of a packet, now with fix!) updated by wififreedom: What I think happened: In spudec_assemble, the invalid len < 2 …
12:32 AM Ticket #2432 (spudec_process_control can read beyond the end of a packet, now with fix!) updated by wififreedom: Here's the relevant part, as I decoded it manually. […]

9:29 PM Ticket #2432 (spudec_process_control can read beyond the end of a packet, now with fix!) updated by beastd: Could you attach e.g. hex dump of the case that failed for you? Think …

8:43 PM Ticket #2432 (spudec_process_control can read beyond the end of a packet, now with fix!) updated by beastd: Status changed
Thanks for the report! Seems there is more problem than one like you …

5:37 PM Ticket #2432 (spudec_process_control can read beyond the end of a packet, now with fix!) updated by wififreedom: Description changed
5:35 PM Ticket #2432 (spudec_process_control can read beyond the end of a packet, now with fix!) updated by wififreedom: Summary changed
5:34 PM Ticket #2432 (spudec_process_control can read beyond the end of a packet, now with fix!) updated by wififreedom: The above fixes in spudec_assemble should be enough to cause …
5:29 PM Ticket #2432 (spudec_process_control can read beyond the end of a packet, now with fix!) updated by wififreedom: Fix, part 2: Then, also in spudec_assemble, there is a kludge between …
5:22 PM Ticket #2432 (spudec_process_control can read beyond the end of a packet, now with fix!) updated by wififreedom: OK. I've got a fix. First of all, in spudec_assemble, there is this …
9:35 AM Ticket #2432 (spudec_process_control can read beyond the end of a packet, now with fix!) updated by wififreedom: spudec_process_control should not read beyond the available data. …
8:48 AM Ticket #2432 (spudec_process_control can read beyond the end of a packet, now with fix!) created by wififreedom: […] The above loop does not check for end of packet. I have just …

Note: See TracTimeline for information about the timeline view.