From abe3e2f42243dafad206db27f08b05d3916f65e3 Mon Sep 17 00:00:00 2001 From: Jonathon Jongsma Date: Fri, 1 Sep 2017 13:49:48 -0500 Subject: [PATCH] Dispatcher: validate received message types Although dispatcher_send_message() does not allow you to send a message type that is invalid for a dispatcher, it still makes sense to verify that the type is valid in the receiver. This should only be possible in the case of some severe problem such as memory corruption, so if it is invalid, we simply abort. Signed-off-by: Jonathon Jongsma Acked-by: Frediano Ziglio --- server/dispatcher.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/server/dispatcher.c b/server/dispatcher.c index 4e03ea04..6f2c4d85 100644 --- a/server/dispatcher.c +++ b/server/dispatcher.c @@ -285,6 +285,10 @@ static int dispatcher_handle_single_read(Dispatcher *dispatcher) /* no messsage */ return 0; } + if (type >= dispatcher->priv->max_message_type) { + spice_error("Invalid message type for this dispatcher: %u", type); + return 0; + } msg = &dispatcher->priv->messages[type]; if (read_safe(dispatcher->priv->recv_fd, payload, msg->size, 1) == -1) { spice_printerr("error reading from dispatcher: %d", errno);