fixeria submitted this change.
proxy: clck_gen_timer_cb(): sanitize expire_count
The number of timer expirations read from the timerfd is used as the
loop boundary. It is already bounded indirectly by the PC clock skew
check, but let's also check it explicitly against the
same CLCK_GEN_MAX_FN_SKEW limit.
Change-Id: I55f736c9bff58034c197f876206efc817da30204
Fixes: CID#564331
---
M proxy/src/clck_gen.c
1 file changed, 10 insertions(+), 0 deletions(-)
diff --git a/proxy/src/clck_gen.c b/proxy/src/clck_gen.c
index 39abc6c..2798b88 100644
--- a/proxy/src/clck_gen.c
+++ b/proxy/src/clck_gen.c
@@ -99,6 +99,16 @@
return 0;
}
+ /* the number of expirations is also bounded by the skew limit */
+ if (expire_count > CLCK_GEN_MAX_FN_SKEW) {
+ LOGP(DTRXC, LOGL_FATAL,
+ "Too many timer expirations (%" PRIu64 "): "
+ "stopping the TDMA clock generator\n",
+ expire_count);
+ clck_gen_stop(gen);
+ return 0;
+ }
+
while (expire_count-- > 0) {
const struct proxy_trx *trx;
To view, visit change 43736. To unsubscribe, or for help writing mail filters, visit settings.