From: Christian Hopps <chopps@labn.net>
Date: Sat, 30 Dec 2023 14:48:15 +0000 (+0000)
Subject: lib: fix coverity CID 1574979
X-Git-Tag: base_10.0~164^2~3
X-Git-Url: https://git.puffer.fish/?a=commitdiff_plain;h=b28cd405c82ec41e51e11e773594d88da1339edb;p=matthieu%2Ffrr.git

lib: fix coverity CID 1574979

Signed-off-by: Christian Hopps <chopps@labn.net>
---

diff --git a/lib/mgmt_msg.c b/lib/mgmt_msg.c
index b03dbe8cc3..23cfbc3b01 100644
--- a/lib/mgmt_msg.c
+++ b/lib/mgmt_msg.c
@@ -111,6 +111,11 @@ enum mgmt_msg_rsched mgmt_msg_read(struct mgmt_msg_state *ms, int fd,
 			 * therefor the stream is too small to fit the message..
 			 * Resize the stream to fit.
 			 */
+			if (mhdr->len > MGMT_MSG_MAX_MSG_ALLOC_LEN) {
+				MGMT_MSG_ERR(ms, "corrupt msg len rcvd %u",
+					     mhdr->len);
+				return MSR_DISCONNECT;
+			}
 			news = stream_new(mhdr->len);
 			stream_put(news, mhdr, left);
 			stream_set_endp(news, left);
diff --git a/lib/mgmt_msg.h b/lib/mgmt_msg.h
index 3195d4a7fb..6bdc9a6cfc 100644
--- a/lib/mgmt_msg.h
+++ b/lib/mgmt_msg.h
@@ -24,6 +24,8 @@ DECLARE_MTYPE(MSG_CONN);
 #define MGMT_MSG_VERSION_PROTOBUF 0
 #define MGMT_MSG_VERSION_NATIVE 1
 
+/* The absolute maximum message size (16MB) */
+#define MGMT_MSG_MAX_MSG_ALLOC_LEN (16 * 1024 * 1024)
 
 struct mgmt_msg_state {
 	struct stream *ins;