ncp: validate salvage scan path request

2026-05-31 18:17:19 +00:00
parent e47a745d0b
commit 3b03a57c76
1 changed files with 17 additions and 0 deletions
--- a/src/namspace.c
+++ b/src/namspace.c
@@ -2797,6 +2797,23 @@ int handle_func_0x57_salvage_scan(uint8 *q, int request_len,
  scan_sequence = GET_32(q + 7);
  nwpathstruct = (NW_HPATH *)(q + 11);

+  {
+    uint8 *pp = nwpathstruct->pathes;
+    uint8 *end = q + request_len;
+    int k;
+
+    for (k = 0; k < nwpathstruct->components; k++) {
+      int len;
+
+      if (pp >= end)
+        return(-0xfb);
+      len = (int)*pp++;
+      if (len > (int)(end - pp))
+        return(-0xfb);
+      pp += len;
+    }
+  }
+
  result = build_base(namespace, nwpathstruct, nwpathstruct->pathes,
                      0, NULL, 0);
  if (result < 0)