Changeset 920:cb439d57d0c5 in freeDiameter

Timestamp:

Feb 13, 2013, 2:42:33 AM (11 years ago)

Author:

Sebastien Decugis <sdecugis@freediameter.net>

Branch:

default

Phase:

public

Message:

Fix parsing of incoming AVPs with 0-byte length at the end of the message

File:

• libfdproto/messages.c (modified) (3 diffs)

libfdproto/messages.c

@@ -1653 +1653 @@
                 struct avp * avp;
                 
-                if (buflen - offset <= AVPHDRSZ_NOVEND) {
+                if (buflen - offset < AVPHDRSZ_NOVEND) {
                         TRACE_DEBUG(INFO, "truncated buffer: remaining only %d bytes", buflen - offset);
                         return EBADMSG;
@@ -1671 +1671 @@
                 
                 if (avp->avp_public.avp_flags & AVP_FLAG_VENDOR) {
-                        if (buflen - offset <= 4) {
+                        if (buflen - offset < 4) {
                                 TRACE_DEBUG(INFO, "truncated buffer: remaining only %d bytes for vendor and data", buflen - offset);
                                 free(avp);
@@ -1681 +1681 @@
                 
                 /* Check there is enough remaining data in the buffer */
-                if (buflen - offset < avp->avp_public.avp_len - GETAVPHDRSZ(avp->avp_public.avp_flags)) {
+                if ( (avp->avp_public.avp_len > GETAVPHDRSZ(avp->avp_public.avp_flags))
+                && (buflen - offset < avp->avp_public.avp_len - GETAVPHDRSZ(avp->avp_public.avp_flags))) {
                         TRACE_DEBUG(INFO, "truncated buffer: remaining only %d bytes for data, and avp data size is %d", 
                                         buflen - offset,