ham-ref/satdump
1
0
Fork 0
mirror of https://github.com/SatDump/SatDump synced 2026-08-13 17:47:30 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

Security hardening in the SDR server

Browse source 
I found this bug the hard way!
This commit is contained in:
Jamie Vital 2024-02-22 16:02:52 -05:00
parent 014628537a
commit aed15489f7
1 changed files with 24 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

32
plugins/sdr_sources/remote_sdr_support/tcp_proto.h
View file

@ -136,13 +136,23 @@ public:
{
int lpkt_size = sread(buffer, 4);
if (lpkt_size == -1)
continue;
if (lpkt_size < 4)
{
clientsockfd = -1;
logger->error("Client sent a packet that was too small. Closing connection!");
closeconn();
continue;
}
int current_pkt_size = lpkt_size;
int expected_pkt_size = uint32_t(buffer[0] << 24 | buffer[1] << 16 | buffer[2] << 8 | buffer[3]) + 4;
if (expected_pkt_size > 3000000)
{
logger->error("Reported packet size too large. Closing connection!");
closeconn();
continue;
}
while (current_pkt_size < expected_pkt_size)
{
int ret = sread(buffer + current_pkt_size, expected_pkt_size - current_pkt_size);
@ -169,14 +179,8 @@ private:
if (ret <= 0)
{
logger->trace("Server lost client");
#if defined(_WIN32)
closesocket(clientsockfd);
#else
close(clientsockfd);
#endif
clientsockfd = -1;
closeconn();
ret = -1;
callback_func_on_lost_client();
}
return ret;
}
@ -200,6 +204,18 @@ public:
}
write_mtx.unlock();
}
private:
void closeconn()
{
#if defined(_WIN32)
closesocket(clientsockfd);
#else
close(clientsockfd);
#endif
clientsockfd = -1;
callback_func_on_lost_client();
}
};
class TCPClient