Skip to content

Commit

Permalink
make sure invalid data won't allocate too much memory
Browse files Browse the repository at this point in the history
  • Loading branch information
dernasherbrezon committed Aug 23, 2024
1 parent fb387f5 commit 21dbb9d
Show file tree
Hide file tree
Showing 3 changed files with 9 additions and 0 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,9 @@ public TransferFrameSecondaryHeader() {
public TransferFrameSecondaryHeader(BitInputStream bis) throws IOException {
version = bis.readUnsignedInt(2);
length = bis.readUnsignedInt(6);
if (length > bis.available()) {
throw new IOException("invalid length: " + length);
}
payload = new byte[length];
bis.readFully(payload);
}
Expand Down
3 changes: 3 additions & 0 deletions src/main/java/ru/r2cloud/jradio/eirsat/EirsatBeacon.java
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,9 @@ public class EirsatBeacon extends TransferFrame {
@Override
public void readBeacon(DataInputStream dis) throws IOException, UncorrectableException {
if (getHeader().getFieldStatus().getFirstHeaderPointer() != 0) {
if (getHeader().getFieldStatus().getFirstHeaderPointer() > dis.available()) {
throw new UncorrectableException("invalid header offset: " + getHeader().getFieldStatus().getFirstHeaderPointer());
}
byte[] payload = new byte[getHeader().getFieldStatus().getFirstHeaderPointer()];
dis.readFully(payload);
Packet partial = new Packet();
Expand Down
3 changes: 3 additions & 0 deletions src/main/java/ru/r2cloud/jradio/netsat/NetSatBeacon.java
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,9 @@ public void readBeacon(byte[] data) throws IOException, UncorrectableException {
if (compassHeader.getPayloadSize() == 53) {
modelPacket = new ModelPacket(ldis);
} else {
if (compassHeader.getPayloadSize() > ldis.available()) {
throw new UncorrectableException("invalid header size: " + compassHeader.getPayloadSize());
}
unknownPayload = new byte[compassHeader.getPayloadSize()];
ldis.readFully(unknownPayload);
}
Expand Down

0 comments on commit 21dbb9d

Please sign in to comment.