diff --git a/common/src/tfe_ctrl_packet.cpp b/common/src/tfe_ctrl_packet.cpp index c063e31..2af8876 100644 --- a/common/src/tfe_ctrl_packet.cpp +++ b/common/src/tfe_ctrl_packet.cpp @@ -117,11 +117,12 @@ static int fqdn_id_set_cmsg(struct ctrl_pkt_parser *handler, mpack_node_t node) static int sids_array_parse_mpack(struct ctrl_pkt_parser *handler, mpack_node_t node, int is_seq) { struct sids *sid = is_seq ? &handler->seq_sids : &handler->ack_sids; - if (mpack_node_array_length(node) > MR_SID_LIST_MAXLEN) { + sid->num = mpack_node_array_length(node); + if (sid->num > MR_SID_LIST_MAXLEN) { + TFE_LOG_ERROR(g_packet_io_logger, "%s: session %lu unexpected control packet: (%s sid num[%d] is invalid, over max num[%d])", LOG_TAG_CTRLPKT, handler->session_id, is_seq ? "seq" : "ack", sid->num, MR_SID_LIST_MAXLEN); return -1; } - sid->num = mpack_node_array_length(node); for (int i = 0; i < sid->num; i++) { sid->elems[i] = mpack_node_u16(mpack_node_array_at(node, i)); @@ -134,7 +135,7 @@ static int route_ctx_parse_mpack(struct ctrl_pkt_parser *handler, mpack_node_t n struct route_ctx *ctx = is_seq ? &handler->seq_route_ctx : &handler->ack_route_ctx; size_t len = mpack_node_bin_size(node); if (len < 0 || len > 64) { - TFE_LOG_ERROR(g_packet_io_logger, "%s: session %lu unexpected control packet: (%s route len[%ld] is invalid)", LOG_TAG_CTRLPKT, handler->session_id, is_seq ? "seq" : "ack", len); + TFE_LOG_ERROR(g_packet_io_logger, "%s: session %lu unexpected control packet: (%s route len[%ld] is invalid, over max size[64])", LOG_TAG_CTRLPKT, handler->session_id, is_seq ? "seq" : "ack", len); return -1; } @@ -149,7 +150,7 @@ static int pkt_header_parse_mpack(struct ctrl_pkt_parser *handler, mpack_node_t int *header_len = is_seq ? &handler->seq_len : &handler->ack_len; size_t len = mpack_node_bin_size(node); if (len < 0) { - TFE_LOG_ERROR(g_packet_io_logger, "%s: session %lu unexpected control packet: (%s package header len[%ld] is invalid)", LOG_TAG_CTRLPKT, handler->session_id, is_seq ? "seq" : "ack", len); + TFE_LOG_ERROR(g_packet_io_logger, "%s: session %lu unexpected control packet: (%s packet header len[%ld] is invalid)", LOG_TAG_CTRLPKT, handler->session_id, is_seq ? "seq" : "ack", len); return -1; } @@ -162,7 +163,7 @@ static int pkt_header_parse_mpack(struct ctrl_pkt_parser *handler, mpack_node_t return 0; } -static void mpack_parse_uint(struct ctrl_pkt_parser *handler, mpack_node_t node, int table_index) +static int mpack_parse_uint(struct ctrl_pkt_parser *handler, mpack_node_t node, int table_index) { uint64_t value = 0; int mode = mpack_table[table_index].mode; @@ -181,6 +182,32 @@ static void mpack_parse_uint(struct ctrl_pkt_parser *handler, mpack_node_t node, case VARIABLE_MODE: if (mpack_table[table_index].type == MPACK_VAR_FLAG) { handler->intercpet_data = mpack_node_u8(node); + if (handler->intercpet_data == 0) { + if (handler->seq_sids.num == 0) { + TFE_LOG_ERROR(g_packet_io_logger, "%s: session %lu unexpected control packet: (seq sid num is 0)", LOG_TAG_CTRLPKT, handler->session_id); + return -1; + } + if (handler->ack_sids.num == 0) { + TFE_LOG_ERROR(g_packet_io_logger, "%s: session %lu unexpected control packet: (ack sid num is 0)", LOG_TAG_CTRLPKT, handler->session_id); + return -1; + } + if (handler->seq_route_ctx.len == 0) { + TFE_LOG_ERROR(g_packet_io_logger, "%s: session %lu unexpected control packet: (seq route ctx len is 0)", LOG_TAG_CTRLPKT, handler->session_id); + return -1; + } + if (handler->ack_route_ctx.len == 0) { + TFE_LOG_ERROR(g_packet_io_logger, "%s: session %lu unexpected control packet: (ack route ctx len is 0)", LOG_TAG_CTRLPKT, handler->session_id); + return -1; + } + if (handler->seq_len == 0) { + TFE_LOG_ERROR(g_packet_io_logger, "%s: session %lu unexpected control packet: (seq packet header len is 0)", LOG_TAG_CTRLPKT, handler->session_id); + return -1; + } + if (handler->ack_len == 0) { + TFE_LOG_ERROR(g_packet_io_logger, "%s: session %lu unexpected control packet: (ack packet header len is 0)", LOG_TAG_CTRLPKT, handler->session_id); + return -1; + } + } } else if (mpack_table[table_index].type == MPACK_VAR_WSACLE_CLIENT_FLAG) { handler->wsacle_client_flag = mpack_node_u8(node); @@ -190,7 +217,7 @@ static void mpack_parse_uint(struct ctrl_pkt_parser *handler, mpack_node_t node, } break; } - return; + return 0; } static void mpack_parse_str(struct ctrl_pkt_parser *handler, mpack_node_t node, int table_index) @@ -290,7 +317,9 @@ static int proxy_parse_messagepack(mpack_node_t node, void *ctx, void *logger) switch (mpack_node_type(ptr)) { case mpack_type_uint: - mpack_parse_uint(handler, ptr, i); + ret = mpack_parse_uint(handler, ptr, i); + if (ret != 0) + return -1; break; case mpack_type_str: mpack_parse_str(handler, ptr, i);