diff options
author | Andreas Schneider <asn@cryptomilk.org> | 2015-02-02 16:54:22 +0100 |
---|---|---|
committer | Andreas Schneider <asn@cryptomilk.org> | 2015-02-02 17:32:28 +0100 |
commit | 6789170799e6f6bf7bad96b4341017b7a931fa88 (patch) | |
tree | 51cace041b288e4b81486537ee9eb31acb7f4f0f | |
parent | afc9988c933ed74bd4c302d685f1b4d7e1960aab (diff) | |
download | libssh-6789170799e6f6bf7bad96b4341017b7a931fa88.tar.gz libssh-6789170799e6f6bf7bad96b4341017b7a931fa88.tar.xz libssh-6789170799e6f6bf7bad96b4341017b7a931fa88.zip |
buffer: Abort if the canary is not intact in ssh_buffer_unpack()
Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
Reviewed-by: Aris Adamantiadis <aris@0xbadc0de.be>
-rw-r--r-- | src/buffer.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/src/buffer.c b/src/buffer.c index 5eb3bb56..6bf268a4 100644 --- a/src/buffer.c +++ b/src/buffer.c @@ -787,10 +787,10 @@ int ssh_buffer_pack_va(struct ssh_buffer_struct *buffer, } if (rc != SSH_ERROR){ - /* verify that the last hidden argument is correct */ - o.dword = va_arg(ap, uint32_t); - if (o.dword != SSH_BUFFER_PACK_END){ - rc = SSH_ERROR; + /* Check if our canary is intact, if not somthing really bad happened */ + uint32_t canary = va_arg(ap, uint32_t); + if (canary != SSH_BUFFER_PACK_END) { + abort(); } } return rc; |