Close #38

cbeuw · Oct 5, 2018 · 59dca46 · 59dca46
1 parent b0102f8
commit 59dca46
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 0 deletions.
diff --git a/gqclient/util.go b/gqclient/util.go
@@ -2,6 +2,7 @@ package gqclient
 
 import (
  "crypto/rand"
+ "errors"
  "io"
  "math/big"
  prand "math/rand"
@@ -60,6 +61,10 @@ func ReadTillDrain(conn net.Conn, buffer []byte) (n int, err error) {
 
  conn.SetReadDeadline(time.Now().Add(3 * time.Second))
  for left != 0 {
+ if readPtr > len(buffer) || readPtr+left > len(buffer) {
+ err = errors.New("Reading TLS message: actual size greater than header's specification")
+ return
+ }
  // If left > buffer size (i.e. our message got segmented), the entire MTU is read
  // if left = buffer size, the entire buffer is all there left to read
  // if left < buffer size (i.e. multiple messages came together),

diff --git a/gqserver/util.go b/gqserver/util.go
@@ -1,6 +1,7 @@
 package gqserver
 
 import (
+ "errors"
  "io"
  prand "math/rand"
  "net"
@@ -47,6 +48,10 @@ func ReadTillDrain(conn net.Conn, buffer []byte) (n int, err error) {
 
  conn.SetReadDeadline(time.Now().Add(3 * time.Second))
  for left != 0 {
+ if readPtr > len(buffer) || readPtr+left > len(buffer) {
+ err = errors.New("Reading TLS message: actual size greater than header's specification")
+ return
+ }
  // If left > buffer size (i.e. our message got segmented), the entire MTU is read
  // if left = buffer size, the entire buffer is all there left to read
  // if left < buffer size (i.e. multiple messages came together),