Alawn/shadowsocks-libev
1
0
Fork 0
mirror of https://github.com/shadowsocks/shadowsocks-libev.git synced 2026-10-29 20:43:44 +00:00
Code Releases Activity

fix a buffer overflow

Browse Source
This commit is contained in:
Max Lv
2015-09-17 14:19:07 +08:00
parent 53c2900b19
commit b49edb9095
3 changed files with 11 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/encrypt.c
+9 -7
View File
@@ -868,7 +868,9 @@ void cipher_context_set_iv(cipher_ctx_t *ctx, uint8_t *iv, size_t iv_len,
return;
}
memcpy(ctx->iv, iv, iv_len);
if (!enc) {
memcpy(ctx->iv, iv, iv_len);
}
if (enc_method >= SALSA20) {
return;
@@ -1533,10 +1535,10 @@ int ss_check_crc(char *buf, ssize_t *buf_len, char *crc_buf, ssize_t *crc_idx)
}
crc_buf[cidx] = buf[i];
cidx++;
if (cidx == CRC_BUF_LEN + 2) {
if (cidx == CRC_BUF_LEN + CRC_BYTES) {
uint16_t c = crc16((const void*)crc_buf, CRC_BUF_LEN);
c = htons(c);
if (memcmp(&c, crc_buf + CRC_BUF_LEN, 2) != 0) return 0;
if (memcmp(&c, crc_buf + CRC_BUF_LEN, CRC_BYTES) != 0) return 0;
cidx = 0;
}
}
@@ -1550,7 +1552,7 @@ char *ss_gen_crc(char *buf, ssize_t *buf_len, char *crc_buf, ssize_t *crc_idx, i
int i, j;
ssize_t blen = *buf_len;
ssize_t cidx = *crc_idx;
int size = max(blen / CRC_BUF_LEN * 2 + blen, buf_size);
int size = max((blen / CRC_BUF_LEN + 1) * CRC_BYTES + blen, buf_size);
if (buf_size < size) {
buf = realloc(buf, size);
@@ -1559,9 +1561,9 @@ char *ss_gen_crc(char *buf, ssize_t *buf_len, char *crc_buf, ssize_t *crc_idx, i
if (cidx == CRC_BUF_LEN) {
uint16_t c = crc16((const void*)crc_buf, CRC_BUF_LEN);
c = htons(c);
memmove(buf + j + 2, buf + j, blen - i);
memcpy(buf + j, &c, 2);
j += 2; cidx = 0;
memmove(buf + j + CRC_BYTES, buf + j, blen - i);
memcpy(buf + j, &c, CRC_BYTES);
j += CRC_BYTES; cidx = 0;
}
crc_buf[cidx] = buf[j];
cidx++;
src/encrypt.h
+1
View File
@@ -147,6 +147,7 @@ typedef struct {
#define ADDRTYPE_MASK 0xF
#define CRC_BUF_LEN 128
#define CRC_BYTES 2
#define min(a, b) (((a) < (b)) ? (a) : (b))
#define max(a, b) (((a) > (b)) ? (a) : (b))
src/server.h
+1 -1
View File
@@ -58,7 +58,7 @@ struct server {
int auth;
ssize_t crc_idx;
char crc_buf[CRC_BUF_LEN + 2]; // 2 bytes for CRC16
char crc_buf[CRC_BUF_LEN + CRC_BYTES]; // 2 bytes for CRC16
struct enc_ctx *e_ctx;
struct enc_ctx *d_ctx;