diff options
| author | Björn-Egil Dahlberg <[email protected]> | 2011-02-22 16:50:51 +0100 |
|---|---|---|
| committer | Björn-Egil Dahlberg <[email protected]> | 2011-02-22 16:50:56 +0100 |
| commit | 7bc880298b2f0994f2902cb0290e4fd035b01865 (patch) | |
| tree | 99fd86fbcdc9daacee03df1b0438ad3ba1372fc0 /lib/erl_interface/src/decode/decode_ref.c | |
| parent | 91275b07fb6151b1ec201ac9c8380b7b96724b63 (diff) | |
| parent | 0b9795fa8145dcb06639cbb67a376e440b4fbc92 (diff) | |
| download | otp-7bc880298b2f0994f2902cb0290e4fd035b01865.tar.gz otp-7bc880298b2f0994f2902cb0290e4fd035b01865.tar.bz2 otp-7bc880298b2f0994f2902cb0290e4fd035b01865.zip | |
Merge branch 'ms/ei-buffer-overflow-when-decoding-atoms' into dev
* ms/ei-buffer-overflow-when-decoding-atoms:
ei: buffer overflow when decoding atoms
OTP-9072
Diffstat (limited to 'lib/erl_interface/src/decode/decode_ref.c')
| -rw-r--r-- | lib/erl_interface/src/decode/decode_ref.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/lib/erl_interface/src/decode/decode_ref.c b/lib/erl_interface/src/decode/decode_ref.c index 6fc2cd6533..691b51fe2d 100644 --- a/lib/erl_interface/src/decode/decode_ref.c +++ b/lib/erl_interface/src/decode/decode_ref.c @@ -35,6 +35,8 @@ int ei_decode_ref(const char *buf, int *index, erlang_ref *p) len = get16be(s); + if (len > MAXATOMLEN) return -1; + if (p) { memmove(p->node, s, len); p->node[len] = (char)0; @@ -62,6 +64,7 @@ int ei_decode_ref(const char *buf, int *index, erlang_ref *p) /* then the nodename */ if (get8(s) != ERL_ATOM_EXT) return -1; len = get16be(s); + if (len > MAXATOMLEN) return -1; if (p) { memmove(p->node, s, len); |