shithub: riscv

Info  •  Files  •  Log  •  Branches

libauth: add sanity check for auth_proxy write size

--- a/sys/src/libauth/auth_proxy.c

+++ b/sys/src/libauth/auth_proxy.c

@@ -157,9 +157,10 @@

 			n = 0;

 			memset(buf, 0, AuthRpcMax);

 			while((ret = dorpc(rpc, "write", buf, n, getkey)) == ARtoosmall){

-				if(atoi(rpc->arg) > AuthRpcMax)

+				m = atoi(rpc->arg);

+				if(m <= n || m > AuthRpcMax)

 					break;

-				m = read(fd, buf + n, atoi(rpc->arg) - n);

+				m = read(fd, buf + n, m - n);

 				if(m <= 0){

 					if(m == 0)

 						werrstr("auth_proxy short read: %s",