Validated received clipboard data size #4601

This commit is contained in:
Jerry (Xinyu Hou) 2015-05-19 14:28:38 -07:00
parent 2c74a7f5c1
commit a6dfbbe021
1 changed files with 9 additions and 1 deletions

View File

@ -546,6 +546,7 @@ ServerProxy::setClipboard()
{ {
// parse // parse
static String dataCached; static String dataCached;
static size_t expectedSize;
ClipboardID id; ClipboardID id;
UInt32 seqNum; UInt32 seqNum;
size_t mark = 0; size_t mark = 0;
@ -553,7 +554,7 @@ ServerProxy::setClipboard()
ProtocolUtil::readf(m_stream, kMsgDClipboard + 4, &id, &seqNum, &mark, &data); ProtocolUtil::readf(m_stream, kMsgDClipboard + 4, &id, &seqNum, &mark, &data);
if (mark == kDataStart) { if (mark == kDataStart) {
//TODO: validate size expectedSize = synergy::string::stringToSizeType(data);
LOG((CLOG_DEBUG "start receiving clipboard data")); LOG((CLOG_DEBUG "start receiving clipboard data"));
dataCached.clear(); dataCached.clear();
} }
@ -562,14 +563,21 @@ ServerProxy::setClipboard()
} }
else if (mark == kDataEnd) { else if (mark == kDataEnd) {
LOG((CLOG_DEBUG "received clipboard %d size=%d", id, dataCached.size())); LOG((CLOG_DEBUG "received clipboard %d size=%d", id, dataCached.size()));
// validate // validate
if (id >= kClipboardEnd) { if (id >= kClipboardEnd) {
return; return;
} }
else if (expectedSize != dataCached.size()) {
LOG((CLOG_ERR "corrupted clipboard data, expected size=%d actual size=%d", expectedSize, dataCached.size()));
return;
}
// forward // forward
Clipboard clipboard; Clipboard clipboard;
clipboard.unmarshall(dataCached, 0); clipboard.unmarshall(dataCached, 0);
m_client->setClipboard(id, &clipboard); m_client->setClipboard(id, &clipboard);
expectedSize = 0;
} }
} }