X-Git-Url: https://tinc-vpn.org/git/browse?p=tinc;a=blobdiff_plain;f=src%2Fmeta.c;h=63f565fe5dbf195997027fa28bca3c4e15083e5b;hp=06ab96e454fa5a3ff97bca1a0858b6a730d61815;hb=42ed8fd4cf3b3e527a38c03d713739fcdc6bf520;hpb=a85864809febde02687b52dc2931ac4505f57067;ds=sidebyside

diff --git a/src/meta.c b/src/meta.c
index 06ab96e4..63f565fe 100644
--- a/src/meta.c
+++ b/src/meta.c
@@ -62,6 +62,14 @@ bool send_meta(connection_t *c, const char *buffer, int length) {
 
 	/* Add our data to buffer */
 	if(c->status.encryptout) {
+		/* Check encryption limits */
+		if(length > c->outbudget) {
+			ifdebug(META) logger(LOG_ERR, "Byte limit exceeded for encryption to %s (%s)", c->name, c->hostname);
+			return false;
+		} else {
+			c->outbudget -= length;
+		}
+
 		result = EVP_EncryptUpdate(c->outctx, (unsigned char *)c->outbuf + c->outbufstart + c->outbuflen,
 				&outlen, (unsigned char *)buffer, length);
 		if(!result || outlen < length) {
@@ -175,6 +183,14 @@ bool receive_meta(connection_t *c) {
 		/* Decrypt */
 
 		if(c->status.decryptin && !decrypted) {
+			/* Check decryption limits */
+			if(lenin > c->inbudget) {
+				ifdebug(META) logger(LOG_ERR, "Byte limit exceeded for decryption from %s (%s)", c->name, c->hostname);
+				return false;
+			} else {
+				c->inbudget -= lenin;
+			}
+
 			result = EVP_DecryptUpdate(c->inctx, (unsigned char *)inbuf, &lenout, (unsigned char *)c->buffer + oldlen, lenin);
 			if(!result || lenout != lenin) {
 				logger(LOG_ERR, "Error while decrypting metadata from %s (%s): %s",