fix buffer overflow in opt_meth_setoption
PoC trigger: c=socket.connect('google.com',80) c.setoption(c,'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa')
This commit is contained in:
parent
5a17f79b03
commit
5baa4ad21a
1 changed files with 3 additions and 1 deletions
|
@ -3,6 +3,7 @@
|
|||
* LuaSocket toolkit
|
||||
\*=========================================================================*/
|
||||
#include <string.h>
|
||||
#include <stdlib.h>
|
||||
|
||||
#include "lauxlib.h"
|
||||
|
||||
|
@ -37,9 +38,10 @@ int opt_meth_setoption(lua_State *L, p_opt opt, p_socket ps)
|
|||
while (opt->name && strcmp(name, opt->name))
|
||||
opt++;
|
||||
if (!opt->func) {
|
||||
char msg[45];
|
||||
char* msg = malloc(30+strlen(name));
|
||||
sprintf(msg, "unsupported option `%.35s'", name);
|
||||
luaL_argerror(L, 2, msg);
|
||||
free(msg);
|
||||
}
|
||||
return opt->func(L, ps);
|
||||
}
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue