View | Details | Raw Unified | Return to bug 992
Collapse All | Expand All

(-)a/src/common/packet.cc (-10 / +13 lines)
 Lines 731-742    Link Here 
731
  // read nix-vector
731
  // read nix-vector
732
  NS_ASSERT (!m_nixVector);
732
  NS_ASSERT (!m_nixVector);
733
  uint32_t nixSize = *p++;
733
  uint32_t nixSize = *p++;
734
735
  // if size less than nixSize, the buffer 
736
  // will be overrun, assert
737
  NS_ASSERT (size >= nixSize);
738
734
  size -= nixSize;
739
  size -= nixSize;
735
740
736
  // if size less than zero, the buffer 
737
  // will be overrun, assert
738
  NS_ASSERT (size >= 0);
739
740
  if (nixSize > 4)
741
  if (nixSize > 4)
741
    {
742
    {
742
      Ptr<NixVector> nix = Create<NixVector> ();
743
      Ptr<NixVector> nix = Create<NixVector> ();
 Lines 760-771    Link Here 
760
761
761
  // read metadata
762
  // read metadata
762
  uint32_t metaSize = *p++;
763
  uint32_t metaSize = *p++;
764
765
  // if size less than metaSize, the buffer 
766
  // will be overrun, assert
767
  NS_ASSERT (size >= metaSize);
768
763
  size -= metaSize;
769
  size -= metaSize;
764
770
765
  // if size less than zero, the buffer 
766
  // will be overrun, assert
767
  NS_ASSERT (size >= 0);
768
769
  uint32_t metadataDeserialized = 
771
  uint32_t metadataDeserialized = 
770
    m_metadata.Deserialize (reinterpret_cast<const uint8_t *> (p), metaSize);
772
    m_metadata.Deserialize (reinterpret_cast<const uint8_t *> (p), metaSize);
771
  if (!metadataDeserialized)
773
  if (!metadataDeserialized)
 Lines 780-791    Link Here 
780
782
781
  // read buffer contents
783
  // read buffer contents
782
  uint32_t bufSize = *p++;
784
  uint32_t bufSize = *p++;
783
  size -= bufSize;
784
785
785
  // if size less than zero, the buffer 
786
  // if size less than bufSize, the buffer 
786
  // will be overrun, assert
787
  // will be overrun, assert
787
  NS_ASSERT (size >= 0);
788
  NS_ASSERT (size >= 0);
788
789
790
  size -= bufSize;
791
789
  uint32_t bufferDeserialized =
792
  uint32_t bufferDeserialized =
790
    m_buffer.Deserialize (reinterpret_cast<const uint8_t *> (p), bufSize);
793
    m_buffer.Deserialize (reinterpret_cast<const uint8_t *> (p), bufSize);
791
  if (!bufferDeserialized)
794
  if (!bufferDeserialized)

Return to bug 992