feedc0de/qt-creator
1
0
Fork 0
forked from qt-creator/qt-creator
Code Pull Requests Activity

SSH: Replace assertion by exception.

Browse Source 
We used Q_ASSERT to verify packet validity even for incoming packets,
which means a malicious host could crash QtCreator by sending invalid
data.

Change-Id: Ie2b674d40273d987d91387f41748fbe085c63ed8
Reviewed-by: hjk <qthjk@ovi.com>
This commit is contained in:
Christian Kandeler
2012-06-15 14:01:51 +02:00
committed by hjk
parent 0d20c5b796
commit b2f6c7223d
2 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
src/libs/ssh/sshincomingpacket.cpp
View File

@@ -90,6 +90,9 @@ void SshIncomingPacket::consumeData(QByteArray &newData)
return; return;
} }
if (4 + length() + macLength() < currentDataSize())
throw SSH_SERVER_EXCEPTION(SSH_DISCONNECT_PROTOCOL_ERROR, "Server sent invalid packet.");
const int bytesToTake const int bytesToTake
= qMin<quint32>(length() + 4 + macLength() - currentDataSize(), = qMin<quint32>(length() + 4 + macLength() - currentDataSize(),
newData.size()); newData.size());

1
src/libs/ssh/sshpacket.cpp
View File

@@ -70,7 +70,6 @@ bool AbstractSshPacket::isComplete() const
{ {
if (currentDataSize() < minPacketSize()) if (currentDataSize() < minPacketSize())
return false; return false;
Q_ASSERT(4 + length() + macLength() >= currentDataSize());
return 4 + length() + macLength() == currentDataSize(); return 4 + length() + macLength() == currentDataSize();
} }