[Spice-commits] server/dispatcher.c

[Jonathon Jongsma]

 server/dispatcher.c |    4 ++++
 1 file changed, 4 insertions(+)

New commits:
commit abe3e2f42243dafad206db27f08b05d3916f65e3
Author: Jonathon Jongsma <jjongsma at redhat.com>
Date:   Fri Sep 1 13:49:48 2017 -0500

    Dispatcher: validate received message types
    
    Although dispatcher_send_message() does not allow you to send a message
    type that is invalid for a dispatcher, it still makes sense to verify
    that the type is valid in the receiver. This should only be possible in
    the case of some severe problem such as memory corruption, so if it is
    invalid, we simply abort.
    
    Signed-off-by: Jonathon Jongsma <jjongsma at redhat.com>
    Acked-by: Frediano Ziglio <fziglio at redhat.com>

diff --git a/server/dispatcher.c b/server/dispatcher.c
index 4e03ea04..6f2c4d85 100644
--- a/server/dispatcher.c
+++ b/server/dispatcher.c
@@ -285,6 +285,10 @@ static int dispatcher_handle_single_read(Dispatcher *dispatcher)
         /* no messsage */
         return 0;
     }
+    if (type >= dispatcher->priv->max_message_type) {
+        spice_error("Invalid message type for this dispatcher: %u", type);
+        return 0;
+    }
     msg = &dispatcher->priv->messages[type];
     if (read_safe(dispatcher->priv->recv_fd, payload, msg->size, 1) == -1) {
         spice_printerr("error reading from dispatcher: %d", errno);