From: Guus Sliepen <guus@meshlink.io>
Date: Tue, 28 Apr 2020 18:20:45 +0000 (+0200)
Subject: Fix a potential read from a freed buffer when sending data to a blacklisted node.
X-Git-Url: https://git.meshlink.io/?a=commitdiff_plain;h=1b0f134888b1d6c9acda938fb654cd4dfd295167;p=meshlink

Fix a potential read from a freed buffer when sending data to a blacklisted node.
---

diff --git a/src/meshlink.c b/src/meshlink.c
index 72f484db..4569c9f5 100644
--- a/src/meshlink.c
+++ b/src/meshlink.c
@@ -1950,7 +1950,7 @@ void meshlink_set_error_cb(struct meshlink_handle *mesh, meshlink_error_cb_t cb)
 static bool prepare_packet(meshlink_handle_t *mesh, meshlink_node_t *destination, const void *data, size_t len, vpn_packet_t *packet) {
 	meshlink_packethdr_t *hdr;
 
-	if(len >= MAXSIZE - sizeof(*hdr)) {
+	if(len > MAXSIZE - sizeof(*hdr)) {
 		meshlink_errno = MESHLINK_EINVAL;
 		return false;
 	}
@@ -1972,8 +1972,8 @@ static bool prepare_packet(meshlink_handle_t *mesh, meshlink_node_t *destination
 	memset(hdr, 0, sizeof(*hdr));
 	// leave the last byte as 0 to make sure strings are always
 	// null-terminated if they are longer than the buffer
-	strncpy((char *)hdr->destination, destination->name, (sizeof(hdr)->destination) - 1);
-	strncpy((char *)hdr->source, mesh->self->name, (sizeof(hdr)->source) - 1);
+	strncpy((char *)hdr->destination, destination->name, sizeof(hdr->destination) - 1);
+	strncpy((char *)hdr->source, mesh->self->name, sizeof(hdr->source) - 1);
 
 	memcpy(packet->data + sizeof(*hdr), data, len);
 
@@ -2023,6 +2023,7 @@ bool meshlink_send(meshlink_handle_t *mesh, meshlink_node_t *destination, const
 
 	if(!prepare_packet(mesh, destination, data, len, packet)) {
 		free(packet);
+		return false;
 	}
 
 	// Queue it