From 7ea5602bc6d504a9d78c0849df5cbd27b9fca824 Mon Sep 17 00:00:00 2001 From: Michael Davidsaver Date: Wed, 24 Jun 2026 11:56:47 -0700 Subject: [PATCH] rsrv: catch overflow of extended message size Treat as corruption, and ignore/close --- modules/database/src/ioc/rsrv/camessage.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/modules/database/src/ioc/rsrv/camessage.c b/modules/database/src/ioc/rsrv/camessage.c index 736c39303..e399c5f21 100644 --- a/modules/database/src/ioc/rsrv/camessage.c +++ b/modules/database/src/ioc/rsrv/camessage.c @@ -2417,6 +2417,14 @@ int camessage ( struct client *client ) } msg.m_postsize = ntohl ( pLW[0] ); msg.m_count = ntohl ( pLW[1] ); + if (msg.m_postsize >= 0xffffffff - (sizeof(*mp) + 2 * sizeof ( *pLW ))) { + if(CASDEBUG>0) { + errlogPrintf("Client ext msg size too large 0x%08x\n", + (unsigned)msg.m_postsize); + } + status = RSRV_ERROR; + break; + } msgsize = msg.m_postsize + sizeof(*mp) + 2 * sizeof ( *pLW ); pBody = pLW + 2; }