diff options
| author | Andrey Kleshchev <andreykproductengine@lindenlab.com> | 2023-11-25 00:17:56 +0200 |
|---|---|---|
| committer | akleshchev <117672381+akleshchev@users.noreply.github.com> | 2023-11-27 14:18:19 +0200 |
| commit | 15ea200cfbd972139cefb74b9185700a44a978d0 (patch) | |
| tree | 53f9642c809711e45499708ed2595209fda86277 | |
| parent | 6b3dd7929b4038a2c4c6d1b563a3b0735b3a020d (diff) | |
SL-18098 Crash inside unpackBinaryData
| -rw-r--r-- | indra/llmessage/lldatapacker.cpp | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/indra/llmessage/lldatapacker.cpp b/indra/llmessage/lldatapacker.cpp index 9f7768f78e..b7013dbb6e 100644 --- a/indra/llmessage/lldatapacker.cpp +++ b/indra/llmessage/lldatapacker.cpp @@ -298,6 +298,13 @@ BOOL LLDataPackerBinaryBuffer::unpackBinaryData(U8 *value, S32 &size, const char } htolememcpy(&size, mCurBufferp, MVT_S32, 4); + + if (size < 0) + { + LL_WARNS() << "LLDataPackerBinaryBuffer::unpackBinaryData unpacked invalid size, aborting!" << LL_ENDL; + return FALSE; + } + mCurBufferp += 4; if (!verifyLength(size, name)) |