From aed15489f794f697b60a7ce5fc699c761368daef Mon Sep 17 00:00:00 2001
From: Jamie Vital <jvital2013@gmail.com>
Date: Thu, 22 Feb 2024 16:02:52 -0500
Subject: [PATCH] Security hardening in the SDR server

I found this bug the hard way!
---
 .../remote_sdr_support/tcp_proto.h            | 32 ++++++++++++++-----
 1 file changed, 24 insertions(+), 8 deletions(-)

diff --git a/plugins/sdr_sources/remote_sdr_support/tcp_proto.h b/plugins/sdr_sources/remote_sdr_support/tcp_proto.h
index 922a4de22..ac56535e1 100644
--- a/plugins/sdr_sources/remote_sdr_support/tcp_proto.h
+++ b/plugins/sdr_sources/remote_sdr_support/tcp_proto.h
@@ -136,13 +136,23 @@ public:
             {
                 int lpkt_size = sread(buffer, 4);
                 if (lpkt_size == -1)
+                    continue;
+                if (lpkt_size < 4)
                 {
-                    clientsockfd = -1;
+                    logger->error("Client sent a packet that was too small. Closing connection!");
+                    closeconn();
                     continue;
                 }
 
                 int current_pkt_size = lpkt_size;
                 int expected_pkt_size = uint32_t(buffer[0] << 24 | buffer[1] << 16 | buffer[2] << 8 | buffer[3]) + 4;
+                if (expected_pkt_size > 3000000)
+                {
+                    logger->error("Reported packet size too large. Closing connection!");
+                    closeconn();
+                    continue;
+                }
+
                 while (current_pkt_size < expected_pkt_size)
                 {
                     int ret = sread(buffer + current_pkt_size, expected_pkt_size - current_pkt_size);
@@ -169,14 +179,8 @@ private:
         if (ret <= 0)
         {
             logger->trace("Server lost client");
-#if defined(_WIN32)
-            closesocket(clientsockfd);
-#else
-            close(clientsockfd);
-#endif
-            clientsockfd = -1;
+            closeconn();
             ret = -1;
-            callback_func_on_lost_client();
         }
         return ret;
     }
@@ -200,6 +204,18 @@ public:
         }
         write_mtx.unlock();
     }
+
+private:
+    void closeconn()
+    {
+#if defined(_WIN32)
+        closesocket(clientsockfd);
+#else
+        close(clientsockfd);
+#endif
+        clientsockfd = -1;
+        callback_func_on_lost_client();
+    }
 };
 
 class TCPClient