Fix a potential read from a freed buffer when sending data to a blacklisted node.

[meshlink] / src / meshlink.c

diff --git a/src/meshlink.c b/src/meshlink.c
index 72f484dbfa68c8b99744571a50f77abaf63a6036..4569c9f58fb2cdae484b3b316c1eba044daa636a 100644 (file)
--- a/src/meshlink.c
+++ b/src/meshlink.c
@@ -1950,7 +1950,7 @@ void meshlink_set_error_cb(struct meshlink_handle *mesh, meshlink_error_cb_t cb)
 static bool prepare_packet(meshlink_handle_t *mesh, meshlink_node_t *destination, const void *data, size_t len, vpn_packet_t *packet) {
        meshlink_packethdr_t *hdr;
 
-       if(len >= MAXSIZE - sizeof(*hdr)) {
+       if(len > MAXSIZE - sizeof(*hdr)) {
                meshlink_errno = MESHLINK_EINVAL;
                return false;
        }
@@ -1972,8 +1972,8 @@ static bool prepare_packet(meshlink_handle_t *mesh, meshlink_node_t *destination
        memset(hdr, 0, sizeof(*hdr));
        // leave the last byte as 0 to make sure strings are always
        // null-terminated if they are longer than the buffer
-       strncpy((char *)hdr->destination, destination->name, (sizeof(hdr)->destination) - 1);
-       strncpy((char *)hdr->source, mesh->self->name, (sizeof(hdr)->source) - 1);
+       strncpy((char *)hdr->destination, destination->name, sizeof(hdr->destination) - 1);
+       strncpy((char *)hdr->source, mesh->self->name, sizeof(hdr->source) - 1);
 
        memcpy(packet->data + sizeof(*hdr), data, len);
 
@@ -2023,6 +2023,7 @@ bool meshlink_send(meshlink_handle_t *mesh, meshlink_node_t *destination, const
 
        if(!prepare_packet(mesh, destination, data, len, packet)) {
                free(packet);
+               return false;
        }
 
        // Queue it