diff options
| author | Alon Levy <alevy@redhat.com> | 2010-12-07 12:56:30 +0200 |
|---|---|---|
| committer | Alon Levy <alevy@redhat.com> | 2010-12-07 21:32:34 +0200 |
| commit | 96da0a4819bd72dace93aa1fde3cd3152fed018e (patch) | |
| tree | 5ad55e9e2e8d1853afc89164e7f1e830b966930c /server/inputs_channel.c | |
| parent | 380b5e9dd70edc79d13fe07210fc7ff2c004e842 (diff) | |
| download | spice-96da0a4819bd72dace93aa1fde3cd3152fed018e.tar.gz spice-96da0a4819bd72dace93aa1fde3cd3152fed018e.tar.xz spice-96da0a4819bd72dace93aa1fde3cd3152fed018e.zip | |
server/inputs: return NULL on alloc_buf request for too large message
Diffstat (limited to 'server/inputs_channel.c')
| -rw-r--r-- | server/inputs_channel.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/server/inputs_channel.c b/server/inputs_channel.c index de62bfe5..e53a634b 100644 --- a/server/inputs_channel.c +++ b/server/inputs_channel.c @@ -157,6 +157,10 @@ static uint8_t *inputs_channel_alloc_msg_rcv_buf(RedChannel *channel, SpiceDataH { InputsChannel *inputs_channel = SPICE_CONTAINEROF(channel, InputsChannel, base); + if (msg_header->size > RECEIVE_BUF_SIZE) { + red_printf("error: too large incoming message"); + return NULL; + } return inputs_channel->recv_buf; } |