[GNUnet-SVN] r37807 - gnunet/src/psyc

[gnunet]

Author: grothoff
Date: 2016-08-27 18:38:02 +0200 (Sat, 27 Aug 2016)
New Revision: 37807

Modified:
   gnunet/src/psyc/psyc_api.c
Log:
-proper checks for inbound messages being well-formed

Modified: gnunet/src/psyc/psyc_api.c
===================================================================
--- gnunet/src/psyc/psyc_api.c  2016-08-27 16:33:40 UTC (rev 37806)
+++ gnunet/src/psyc/psyc_api.c  2016-08-27 16:38:02 UTC (rev 37807)
@@ -304,7 +304,8 @@
     pmsg = (struct GNUNET_PSYC_MessageHeader *) GNUNET_MQ_extract_nested_mh 
(res);
   uint16_t size = ntohs (res->header.size);
 
-  if (NULL == pmsg || size < sizeof (*res) + sizeof (*pmsg))
+  if ( (NULL == pmsg) ||
+       (size < sizeof (*res) + sizeof (*pmsg)) )
   { /* Error, message too small. */
     GNUNET_break_op (0);
     return GNUNET_SYSERR;
@@ -320,14 +321,14 @@
   struct GNUNET_PSYC_Channel *chn = cls;
   struct GNUNET_PSYC_MessageHeader *
     pmsg = (struct GNUNET_PSYC_MessageHeader *) GNUNET_MQ_extract_nested_mh 
(res);
+  GNUNET_ResultCallback result_cb = NULL;
+  struct GNUNET_PSYC_HistoryRequest *hist = NULL;
 
   LOG (GNUNET_ERROR_TYPE_DEBUG,
        "%p Received historic fragment for message #%" PRIu64 ".\n",
-       chn, GNUNET_ntohll (pmsg->message_id));
+       chn,
+       GNUNET_ntohll (pmsg->message_id));
 
-  GNUNET_ResultCallback result_cb = NULL;
-  struct GNUNET_PSYC_HistoryRequest *hist = NULL;
-
   if (GNUNET_YES != GNUNET_OP_get (chn->op,
                                    GNUNET_ntohll (res->op_id),
                                    &result_cb, (void *) &hist, NULL))
@@ -349,14 +350,21 @@
                             const struct GNUNET_OperationResultMessage *res)
 {
   const struct GNUNET_MessageHeader *mod = GNUNET_MQ_extract_nested_mh (res);
-  uint16_t mod_size = ntohs (mod->size);
-  uint16_t size = ntohs (res->header.size);
+  uint16_t mod_size;
+  uint16_t size;
 
-  if (NULL == mod || size - sizeof (*res) != mod_size)
+  if (NULL == mod)
   {
     GNUNET_break_op (0);
     return GNUNET_SYSERR;
   }
+  mod_size = ntohs (mod->size);
+  size = ntohs (res->header.size);
+  if (size - sizeof (*res) != mod_size)
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
   return GNUNET_OK;
 }
 
@@ -458,6 +466,12 @@
 check_master_join_request (void *cls,
                            const struct GNUNET_PSYC_JoinRequestMessage *req)
 {
+  if ( ((sizeof (*req) + sizeof (struct GNUNET_PSYC_Message)) <= ntohs 
(req->header.size)) &&
+       (NULL == GNUNET_MQ_extract_nested_mh (req)) )
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
   return GNUNET_OK;
 }
 
@@ -477,7 +491,8 @@
     join_msg = (struct GNUNET_PSYC_Message *) GNUNET_MQ_extract_nested_mh 
(req);
     LOG (GNUNET_ERROR_TYPE_DEBUG,
          "Received join_msg of type %u and size %u.\n",
-         ntohs (join_msg->header.type), ntohs (join_msg->header.size));
+         ntohs (join_msg->header.type),
+         ntohs (join_msg->header.size));
   }
 
   struct GNUNET_PSYC_JoinHandle *jh = GNUNET_malloc (sizeof (*jh));