Skip to content

Commit d6c6d23

Browse files
committed
Check bounds on addition with value from peer
Bounds check the bytes to add from the peer against the window size. Affected function: DoChannelWindowAdjust.
1 parent c802a7f commit d6c6d23

1 file changed

Lines changed: 9 additions & 5 deletions

File tree

src/internal.c

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -9469,11 +9469,15 @@ static int DoChannelWindowAdjust(WOLFSSH* ssh,
94699469
WLOG(WS_LOG_INFO, " peerWindowSz = %u",
94709470
channel->peerWindowSz);
94719471

9472-
channel->peerWindowSz += bytesToAdd;
9473-
9474-
WLOG(WS_LOG_INFO, " update peerWindowSz = %u",
9475-
channel->peerWindowSz);
9476-
9472+
if (bytesToAdd > UINT32_MAX - channel->peerWindowSz) {
9473+
ret = WS_OVERFLOW_E;
9474+
WLOG(WS_LOG_DEBUG, "peer window adjust would overflow");
9475+
}
9476+
else {
9477+
channel->peerWindowSz += bytesToAdd;
9478+
WLOG(WS_LOG_INFO, " update peerWindowSz = %u",
9479+
channel->peerWindowSz);
9480+
}
94779481
}
94789482
}
94799483

0 commit comments

Comments
 (0)