Intravision/reactos
1
0
Fork 0
mirror of https://github.com/reactos/reactos.git synced 2024-06-29 01:12:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

[TFTPD] Fix bound checks for array cfig.hostRanges. Spotted by 'mudhead'.

Browse source 
CORE-14515
This commit is contained in:
Hermès Bélusca-Maïto 2018-03-31 16:49:24 +02:00
parent 2eb78afa7a
commit af57aba104
No known key found for this signature in database
GPG key ID: 3B2539C65E7B93D0
1 changed files with 12 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
base/services/tftpd/tftpd.cpp
View file

@ -540,7 +540,11 @@ void processRequest(void *lpParam)
MYDWORD iip = ntohl(req.client.sin_addr.s_addr);
bool allowed = false;
#ifdef __REACTOS__
for (int j = 0; j < _countof(cfig.hostRanges) && cfig.hostRanges[j].rangeStart; j++)
#else
for (int j = 0; j <= 32 && cfig.hostRanges[j].rangeStart; j++)
#endif
{
if (iip >= cfig.hostRanges[j].rangeStart && iip <= cfig.hostRanges[j].rangeEnd)
{
@ -2050,7 +2054,11 @@ void init(void *lpParam)
while (readSection(raw, f))
{
#ifdef __REACTOS__
if (i < _countof(cfig.hostRanges))
#else
if (i < 32)
#endif
{
MYDWORD rs = 0;
MYDWORD re = 0;
@ -2098,7 +2106,11 @@ void init(void *lpParam)
{
char temp[128];
#ifdef __REACTOS__
for (int i = 0; i < _countof(cfig.hostRanges) && cfig.hostRanges[i].rangeStart; i++)
#else
for (MYWORD i = 0; i <= sizeof(cfig.hostRanges) && cfig.hostRanges[i].rangeStart; i++)
#endif
{
sprintf(logBuff, "%s", "permitted clients: ");
sprintf(temp, "%s-", IP2String(tempbuff, htonl(cfig.hostRanges[i].rangeStart)));