jayduhon / inferno-os

Automatically exported from code.google.com/p/inferno-os
2 stars 0 forks source link

tiny change to appl/lib/ip.b #186

Closed GoogleCodeExporter closed 9 years ago

GoogleCodeExporter commented 9 years ago
the patch inline, since it's so small:

diff -r 2eb370412ac3 appl/lib/ip.b
--- a/appl/lib/ip.b     Wed Jul 01 00:00:22 2009 +0100
+++ b/appl/lib/ip.b     Fri Jul 17 17:58:29 2009 +0200
@@ -66,7 +66,7 @@

 IPaddr.newv6(a: array of byte): IPaddr
 {
-       b := array[len a] of byte;
+       b := array[IPaddrlen] of byte;
        b[0:] = a[0:IPaddrlen];
        return IPaddr(b);
 }

the thing is:  Udphdr.unpack() calls IPaddr.newv6() with arrays longer than
IPaddrlen.  IPaddr.newv6() creates b with the same longer length.  then
when IPaddr.v6() is called, a copy of the array for IPaddrlen bytes is
created, but the entire array is copied in:

IPaddr.v6(ip: self IPaddr): array of byte
{
        a := array[IPaddrlen] of byte;
        a[0:] = ip.a;
        return a;
}

causing an out of bounds exception.

this happens when you unpack an udp header, and repack it again for a
response message.

Original issue reported on code.google.com by mechiel@ueber.net on 17 Jul 2009 at 4:12

GoogleCodeExporter commented 9 years ago
i've replaced the several uses of len X by IPaddrlen

Original comment by Charles....@gmail.com on 17 Jul 2009 at 4:32