status-im/miniupnp
2
0
Fork 0
mirror of https://github.com/status-im/miniupnp.git synced 2025-02-20 09:48:26 +00:00
Code Issues Projects Releases Wiki Activity

upnpdescgen.c: check for stack overflow in genXML()

Browse Source 
remove two TODO's ! ;)
This commit is contained in:
Thomas Bernard 2017-11-24 11:00:34 +01:00
parent ba9315b9b4
commit 165c5f0d57
1 changed files with 15 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
miniupnpd/upnpdescgen.c
View File

@ -535,16 +535,6 @@ static const struct stateVar WANIPCnVars[] =
{"PortMappingEnabled", 1, 0}, /* Required */ {"PortMappingEnabled", 1, 0}, /* Required */
/* 10 */ /* 10 */
{"PortMappingLeaseDuration", 3, 2, 1}, /* required */ {"PortMappingLeaseDuration", 3, 2, 1}, /* required */
/* TODO : for IGD v2 :
* <stateVariable sendEvents="no">
* <name>PortMappingLeaseDuration</name>
* <dataType>ui4</dataType>
* <defaultValue>Vendor-defined</defaultValue>
* <allowedValueRange>
* <minimum>0</minimum>
* <maximum>604800</maximum>
* </allowedValueRange>
* </stateVariable> */
{"RemoteHost", 0, 0}, /* required. Default : empty string */ {"RemoteHost", 0, 0}, /* required. Default : empty string */
{"ExternalPort", 2, 0}, /* required */ {"ExternalPort", 2, 0}, /* required */
{"InternalPort", 2, 0, 3}, /* required */ {"InternalPort", 2, 0, 3}, /* required */
@ -894,6 +884,7 @@ static char *
genXML(char * str, int * len, int * tmplen, genXML(char * str, int * len, int * tmplen,
const struct XMLElt * p) const struct XMLElt * p)
{ {
#define GENXML_STACK_SIZE 16
unsigned short i, j; unsigned short i, j;
unsigned long k; unsigned long k;
int top; int top;
@ -903,7 +894,7 @@ genXML(char * str, int * len, int * tmplen,
unsigned short i; unsigned short i;
unsigned short j; unsigned short j;
const char * eltname; const char * eltname;
} pile[16]; /* stack */ } pile[GENXML_STACK_SIZE]; /* stack */
top = -1; top = -1;
i = 0; /* current node */ i = 0; /* current node */
j = 1; /* i + number of nodes*/ j = 1; /* i + number of nodes*/
@ -914,6 +905,7 @@ genXML(char * str, int * len, int * tmplen,
return str; return str;
if(eltname[0] == '/') if(eltname[0] == '/')
{ {
/* leaf node */
if(p[i].data && p[i].data[0]) if(p[i].data && p[i].data[0])
{ {
/*printf("<%s>%s<%s>\n", eltname+1, p[i].data, eltname); */ /*printf("<%s>%s<%s>\n", eltname+1, p[i].data, eltname); */
@ -957,6 +949,7 @@ genXML(char * str, int * len, int * tmplen,
} }
else else
{ {
/* node with child(ren) */
/*printf("<%s>\n", eltname); */ /*printf("<%s>\n", eltname); */
str = strcat_char(str, len, tmplen, '<'); str = strcat_char(str, len, tmplen, '<');
str = strcat_str(str, len, tmplen, eltname); str = strcat_str(str, len, tmplen, eltname);
@ -971,11 +964,17 @@ genXML(char * str, int * len, int * tmplen,
k = (unsigned long)p[i].data; k = (unsigned long)p[i].data;
i = k & 0xffff; i = k & 0xffff;
j = i + (k >> 16); j = i + (k >> 16);
top++; /* TODO : check stack overflow ! */ if(top < (GENXML_STACK_SIZE - 1)) {
top++;
/*printf(" +pile[%d]\t%d %d\n", top, i, j); */ /*printf(" +pile[%d]\t%d %d\n", top, i, j); */
pile[top].i = i; pile[top].i = i;
pile[top].j = j; pile[top].j = j;
pile[top].eltname = eltname; pile[top].eltname = eltname;
#ifdef DEBUG
} else {
fprintf(stderr, "*** GenXML(): stack OVERFLOW ***\n");
#endif /* DEBUG */
}
} }
} }
} }