|
@@ -1,70 +0,0 @@
|
1
|
|
-diff --git a/src/main-ctl-unix.c b/src/main-ctl-unix.c
|
2
|
|
-index b4da5eb..90d604f 100644
|
3
|
|
---- a/src/main-ctl-unix.c
|
4
|
|
-+++ b/src/main-ctl-unix.c
|
5
|
|
-@@ -629,7 +629,7 @@ static void ctl_handle_commands(main_server_st * s)
|
6
|
|
- }
|
7
|
|
- goto cleanup;
|
8
|
|
- }
|
9
|
|
-- length = (buffer[2] << 8) | buffer[1];
|
10
|
|
-+ memcpy(&length, &buffer[1], 2);
|
11
|
|
- buffer_size = ret - 3;
|
12
|
|
-
|
13
|
|
- if (length != buffer_size) {
|
14
|
|
-diff --git a/src/occtl-unix.c b/src/occtl-unix.c
|
15
|
|
-index 183825d..0c1b3e1 100644
|
16
|
|
---- a/src/occtl-unix.c
|
17
|
|
-+++ b/src/occtl-unix.c
|
18
|
|
-@@ -83,15 +83,14 @@ int send_cmd(struct unix_ctx *ctx, unsigned cmd, const void *data,
|
19
|
|
- struct iovec iov[2];
|
20
|
|
- unsigned iov_len = 1;
|
21
|
|
- int e, ret;
|
22
|
|
-- unsigned length = 0;
|
23
|
|
-+ uint16_t length = 0;
|
24
|
|
- void *packed = NULL;
|
25
|
|
-
|
26
|
|
- if (get_size)
|
27
|
|
- length = get_size(data);
|
28
|
|
-
|
29
|
|
- header[0] = cmd;
|
30
|
|
-- header[1] = length;
|
31
|
|
-- header[2] = length >> 8;
|
32
|
|
-+ memcpy(&header[1], &length, 2);
|
33
|
|
-
|
34
|
|
- iov[0].iov_base = header;
|
35
|
|
- iov[0].iov_len = 3;
|
36
|
|
-@@ -145,7 +144,7 @@ int send_cmd(struct unix_ctx *ctx, unsigned cmd, const void *data,
|
37
|
|
- goto fail;
|
38
|
|
- }
|
39
|
|
-
|
40
|
|
-- length = (header[2] << 8) | header[1];
|
41
|
|
-+ memcpy(&length, &header[1], 2);
|
42
|
|
-
|
43
|
|
- rep->data_size = length;
|
44
|
|
- rep->data = talloc_size(ctx, length);
|
45
|
|
-diff --git a/src/sec-mod.c b/src/sec-mod.c
|
46
|
|
-index 15ee32a..c3d4bad 100644
|
47
|
|
---- a/src/sec-mod.c
|
48
|
|
-+++ b/src/sec-mod.c
|
49
|
|
-@@ -354,6 +354,7 @@ void sec_mod_server(void *main_pool, struct cfg_st *config, const char *socket_f
|
50
|
|
- unsigned cmd, length;
|
51
|
|
- unsigned i, buffer_size;
|
52
|
|
- uint8_t *buffer, *tpool;
|
53
|
|
-+ uint16_t l16;
|
54
|
|
- struct pin_st pins;
|
55
|
|
- int sd;
|
56
|
|
- sec_mod_st *sec;
|
57
|
|
-@@ -538,10 +539,11 @@ void sec_mod_server(void *main_pool, struct cfg_st *config, const char *socket_f
|
58
|
|
- }
|
59
|
|
-
|
60
|
|
- cmd = buffer[0];
|
61
|
|
-- length = buffer[1] | buffer[2] << 8;
|
62
|
|
-+ memcpy(&l16, &buffer[1], 2);
|
63
|
|
-+ length = l16;
|
64
|
|
-
|
65
|
|
- if (length > buffer_size - 4) {
|
66
|
|
-- seclog(LOG_INFO, "too big message");
|
67
|
|
-+ seclog(LOG_INFO, "too big message (%d)", length);
|
68
|
|
- goto cont;
|
69
|
|
- }
|
70
|
|
-
|