fix(PIFileTransfer): validate file id before array access
processFile() accessed files_[id - 1] without validating id. When id == 0 (from a crafted network packet), id - 1 = -1 caused out-of-bounds access. Added bounds check: id must be in range [1, files_.size()]. Stops receive and logs error on invalid id.
This commit is contained in:
@@ -131,6 +131,12 @@ bool PIFileTransfer::sendFiles(const PIVector<PFTFileInfo> & files) {
|
||||
|
||||
void PIFileTransfer::processFile(int id, ullong start, PIByteArray & data) {
|
||||
// piCout << "processFile" << id << files_.size();
|
||||
if (id <= 0 || id > files_.size_s()) {
|
||||
cur_file_string = "Error: Invalid file id " + PIString::fromNumber(id);
|
||||
piCoutObj << cur_file_string;
|
||||
stopReceive();
|
||||
return;
|
||||
}
|
||||
PFTFileInfo fi = files_[id - 1];
|
||||
bytes_file_all = fi.size;
|
||||
bytes_file_cur = start;
|
||||
|
||||
Reference in New Issue
Block a user