diff options
| author | Juan Linietsky <reduzio@gmail.com> | 2018-05-08 10:45:39 -0300 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2018-05-08 10:45:39 -0300 |
| commit | 06b076f6871a9524c4fa1af57441527bba03d619 (patch) | |
| tree | dc08519713bc01281d59f12580fc7299b9792789 /core/io | |
| parent | 06f1d1ae23e9c14aa8882ab41330fbfbd2d3424c (diff) | |
| parent | df84ecd043425be441c8788a0b696071fc5ddd2c (diff) | |
Merge pull request #15305 from poke1024/checks-peer
Checks on input_buffer in PacketPeerStream
Diffstat (limited to 'core/io')
| -rw-r--r-- | core/io/packet_peer.cpp | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/core/io/packet_peer.cpp b/core/io/packet_peer.cpp index bd851ebb6d..b777a9f960 100644 --- a/core/io/packet_peer.cpp +++ b/core/io/packet_peer.cpp @@ -172,6 +172,7 @@ Error PacketPeerStream::_poll_buffer() const { ERR_FAIL_COND_V(peer.is_null(), ERR_UNCONFIGURED); int read = 0; + ERR_FAIL_COND_V(input_buffer.size() < ring_buffer.space_left(), ERR_UNAVAILABLE); Error err = peer->get_partial_data(&input_buffer[0], ring_buffer.space_left(), read); if (err) return err; @@ -223,6 +224,7 @@ Error PacketPeerStream::get_packet(const uint8_t **r_buffer, int &r_buffer_size) uint32_t len = decode_uint32(lbuf); ERR_FAIL_COND_V(remaining < (int)len, ERR_UNAVAILABLE); + ERR_FAIL_COND_V(input_buffer.size() < len, ERR_UNAVAILABLE); ring_buffer.read(lbuf, 4); //get rid of first 4 bytes ring_buffer.read(&input_buffer[0], len); // read packet |