Protect against giving invalid pointers to writev

[gldbg.git] / source / packet.c

diff --git a/source/packet.c b/source/packet.c
index d31a631d26417db3ee5e6cd3148dc7a005f8b50a..e78b095b512e0850eeaa2dba911db157f3bfa83d 100644 (file)
--- a/source/packet.c
+++ b/source/packet.c
@@ -193,7 +193,14 @@ void packet_write_pointer(GlPacket *pkt, const void *p)
 
 void packet_write_data(GlPacket *pkt, const void *data, unsigned size)
 {
-       if(data)
+       if(!data)
+               packet_write_int(pkt, 0);
+       else if((unsigned long)data<0x100000)
+       {
+               packet_write_int(pkt, ~0);
+               packet_write_pointer(pkt, data);
+       }
+       else
        {
                GlOutPacket *out = &pkt->out;
 
@@ -205,8 +212,6 @@ void packet_write_data(GlPacket *pkt, const void *data, unsigned size)
                ++out->vec;
                out->vec->iov_base = out->ptr;
        }
-       else
-               packet_write_int(pkt, 0);
 }
 
 void packet_write_string(GlPacket *pkt, const char *s)
@@ -408,13 +413,17 @@ void packet_read_data(GlPacket *pkt, const void **v)
        int vlen;
 
        packet_read_int(pkt, &vlen);
-       if(vlen)
+       if(vlen==~0)
+               packet_read_pointer(pkt, v);
+       else if(vlen)
+       {
                *v = in->ptr;
+               in->ptr += vlen;
+               in->chunk -= vlen;
+               in->length -= vlen;
+       }
        else
                *v = NULL;
-       in->ptr += vlen;
-       in->chunk -= vlen;
-       in->length -= vlen;
 }
 
 void packet_read_string(GlPacket *pkt, const char **v)