From d0f50c86900cdfb7f93e2bd6df37d50776219a9a Mon Sep 17 00:00:00 2001 From: lisa neigut Date: Sun, 24 Mar 2019 19:35:25 -0700 Subject: [PATCH] tlv: fail if parsed length doesn't match packet length --- tools/generate-wire.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/tools/generate-wire.py b/tools/generate-wire.py index 9ecad810f..74e436509 100755 --- a/tools/generate-wire.py +++ b/tools/generate-wire.py @@ -850,6 +850,7 @@ tlv__type_impl_towire_template = """static void towire__{tlv_name}(const tal_t * tlv__type_impl_fromwire_template = """static struct {tlv_name} *fromwire__{tlv_name}(const tal_t *ctx, const u8 **p, size_t *plen, const u16 *len) {{ \tu8 msg_type, msg_len; +\tsize_t start_len = *plen; \tif (*plen < *len) \t\treturn NULL; @@ -873,7 +874,7 @@ tlv__type_impl_fromwire_template = """static struct {tlv_name} *fromwire__{tlv_n \t\t\t*plen -= msg_len; \t\t}} \t}} -\tif (!*p) {{ +\tif (!*p || start_len - *plen != *len) {{ \t\ttal_free({tlv_name}); \t\treturn NULL; \t}}