Mirrors/sshj
1
0
Fork 0
mirror of https://github.com/hierynomus/sshj.git synced 2025-12-09 00:18:39 +03:00
Code Issues Actions Packages Projects Releases Wiki Activity

Issue 72: fix for infinite loop if allocate too large a buffer (due to invalid packet size)

Browse Source
This commit is contained in:
Aled Sage
2012-04-26 11:43:29 +01:00
parent ab04596a20
commit fb690c4fb0
4 changed files with 119 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
src/main/java/net/schmizz/sshj/common/Buffer.java
View File

@@ -74,10 +74,15 @@ public class Buffer<T extends Buffer<T>> {
/** The default size for a {@code Buffer} (256 bytes) */
public static final int DEFAULT_SIZE = 256;
/** The maximum valid size of buffer (i.e. biggest power of two that can be represented as an int - 2^30) */
public static final int MAX_SIZE = (1 << 30);
protected static int getNextPowerOf2(int i) {
int j = 1;
while (j < i)
while (j < i) {
j <<= 1;
if (j <= 0) throw new IllegalArgumentException("Cannot get next power of 2; "+i+" is too large");
}
return j;
}

14
src/main/java/net/schmizz/sshj/sftp/PacketReader.java
View File

@@ -15,15 +15,16 @@
*/
package net.schmizz.sshj.sftp;
import net.schmizz.concurrent.Promise;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import java.io.IOException;
import java.io.InputStream;
import java.util.Map;
import java.util.concurrent.ConcurrentHashMap;
import net.schmizz.concurrent.Promise;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
public class PacketReader
extends Thread {
@@ -65,7 +66,10 @@ public class PacketReader
public SFTPPacket<Response> readPacket()
throws IOException {
int len = getPacketLength();
if (len > SFTPPacket.MAX_SIZE) {
throw new IllegalStateException("Invalid packet: indicated length "+len+" too large");
}
packet.rpos(0);
packet.wpos(0);