Ensure send_udp_probe_packet len is valid for the buffer size.
authorMathew Heard <splitice@users.noreply.github.com>
Tue, 29 Jun 2021 04:48:04 +0000 (14:48 +1000)
committerGuus Sliepen <guus@tinc-vpn.org>
Wed, 30 Jun 2021 21:52:01 +0000 (23:52 +0200)
src/net_packet.c

index ff9f79c..25d3efb 100644 (file)
@@ -1087,6 +1087,12 @@ static void send_udp_probe_packet(node_t *n, int len) {
        vpn_packet_t packet;
        packet.offset = DEFAULT_PACKET_OFFSET;
        memset(DATA(&packet), 0, 14);
+
+       if(len > sizeof(packet.data)) {
+               logger(DEBUG_TRAFFIC, LOG_INFO, "Truncating probe length %d to %s (%s)", len, n->name, n->hostname);
+               len = sizeof(packet.data);
+       }
+
        randomize(DATA(&packet) + 14, len - 14);
        packet.len = len;
        packet.priority = 0;