SHS/pip
4
3
Fork 0
Code Issues 16 Pull Requests 2 Actions Releases Wiki Activity

fix(PIFileTransfer): validate file id before array access

Browse Source 
processFile() accessed files_[id - 1] without validating id.
When id == 0 (from a crafted network packet), id - 1 = -1 caused
out-of-bounds access. Added bounds check: id must be in range
[1, files_.size()]. Stops receive and logs error on invalid id.
This commit is contained in:
andrey
2026-08-05 17:39:38 +03:00
parent 27a9f05d65
commit 3f293ebd65
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libs/main/io_utils/pifiletransfer.cpp
+6
View File
@@ -131,6 +131,12 @@ bool PIFileTransfer::sendFiles(const PIVector<PFTFileInfo> & files) {
void PIFileTransfer::processFile(int id, ullong start, PIByteArray & data) { void PIFileTransfer::processFile(int id, ullong start, PIByteArray & data) {
// piCout << "processFile" << id << files_.size(); // piCout << "processFile" << id << files_.size();
if (id <= 0 || id > files_.size_s()) {
cur_file_string = "Error: Invalid file id " + PIString::fromNumber(id);
piCoutObj << cur_file_string;
stopReceive();
return;
}
PFTFileInfo fi = files_[id - 1]; PFTFileInfo fi = files_[id - 1];
bytes_file_all = fi.size; bytes_file_all = fi.size;
bytes_file_cur = start; bytes_file_cur = start;