cardclient-cccam2: precautions against full read buffer

diff --git a/network.c b/network.c
index 2ece6d47413d03a80539a1744b275716be63edfb..a937b61d3f895d8219e6baac244971e3bcbfe86f 100644 (file)
--- a/network.c
+++ b/network.c
@@ -301,6 +301,11 @@ int cNetSocket::Read(unsigned char *data, int len, int timeout)
   if(timeout<0) timeout=rwTimeout;
   bool blockmode=true;
   if(len<0) { len=-len; blockmode=false; }
+  else if(len==0) {
+    PRINTF(L_GEN_DEBUG,"internal: zero length on socket read");
+    errno=EINVAL;
+    return -1;
+    }
   int cnt=0, r;
   cTimeMs tim;
   do {

diff --git a/systems/cardclient/cccam2.c b/systems/cardclient/cccam2.c
index 7564159d3f5375be89e6a3628de14fdc807ac685..313df0b58e8ae1679f606b39e841b8378ff33fd8 100644 (file)
--- a/systems/cardclient/cccam2.c
+++ b/systems/cardclient/cccam2.c
@@ -941,7 +941,13 @@ void cCardClientCCcam2::Action(void)
   int cnt=0;
   while(Running() && so.Connected()) {
     unsigned char recvbuff[1024];
-    int len=CryptRecv(recvbuff+cnt,-(sizeof(recvbuff)-cnt),200);
+    int len=sizeof(recvbuff)-cnt;
+    if(len==0) {
+      HEXDUMP(L_GEN_DEBUG,recvbuff,sizeof(recvbuff),"internal: cccam2 read buffer overflow");
+      Logout();
+      break;
+      }
+    len=CryptRecv(recvbuff+cnt,-len,200);
     if(len>0) {
       HEXDUMP(L_CC_CCCAM2DT,recvbuff+cnt,len,"net read: len=%d cnt=%d",len,cnt+len);
       cnt+=len;
@@ -950,13 +956,17 @@ void cCardClientCCcam2::Action(void)
     while(proc+4<=cnt) {
       struct CmdHeader *hdr=(struct CmdHeader *)(recvbuff+proc);
       int l=CMDLEN(hdr);
+      if(l>(int)sizeof(recvbuff))
+        PRINTF(L_GEN_DEBUG,"internal: cccam2 cmd length exceed buffer size");
       if(proc+l>cnt) break;
       LDUMP(L_CC_CCCAM2DT,hdr,l,"msg in:");
       PacketAnalyzer(hdr,l);
       proc+=l;
       }
-    cnt-=proc;
-    memmove(recvbuff,recvbuff+proc,cnt);
+    if(proc) {
+      cnt-=proc;
+      memmove(recvbuff,recvbuff+proc,cnt);
+      }
     if(lastsend.TimedOut()) {
       static const struct CmdHeader ping = { 0,6,0 };
       if(CryptSend((unsigned char *)&ping,sizeof(ping))<0)