mirrors/scrcpy
0
0
Fork 0
mirror of https://github.com/Genymobile/scrcpy.git synced 2025-08-04 15:19:11 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix device message deserialization checks

Browse source 
If any message is incomplete, the deserialization method must return
immediately.
This commit is contained in:
Romain Vimont 2024-02-23 20:01:30 +01:00
commit 9858eff856
1 changed files with 10 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

14
app/src/device_msg.c
View file

@ -9,17 +9,20 @@
ssize_t ssize_t
device_msg_deserialize(const uint8_t *buf, size_t len, struct device_msg *msg) { device_msg_deserialize(const uint8_t *buf, size_t len, struct device_msg *msg) {
if (len < 5) { if (!len) {
// at least type + empty string length return 0; // no message
return 0; // not available
} }
msg->type = buf[0]; msg->type = buf[0];
switch (msg->type) { switch (msg->type) {
case DEVICE_MSG_TYPE_CLIPBOARD: { case DEVICE_MSG_TYPE_CLIPBOARD: {
if (len < 5) {
// at least type + empty string length
return 0; // no complete message
}
size_t clipboard_len = sc_read32be(&buf[1]); size_t clipboard_len = sc_read32be(&buf[1]);
if (clipboard_len > len - 5) { if (clipboard_len > len - 5) {
return 0; // not available return 0; // no complete message
} }
char *text = malloc(clipboard_len + 1); char *text = malloc(clipboard_len + 1);
if (!text) { if (!text) {
@ -35,6 +38,9 @@ device_msg_deserialize(const uint8_t *buf, size_t len, struct device_msg *msg) {
return 5 + clipboard_len; return 5 + clipboard_len;
} }
case DEVICE_MSG_TYPE_ACK_CLIPBOARD: { case DEVICE_MSG_TYPE_ACK_CLIPBOARD: {
if (len < 9) {
return 0; // no complete message
}
uint64_t sequence = sc_read64be(&buf[1]); uint64_t sequence = sc_read64be(&buf[1]);
msg->ack_clipboard.sequence = sequence; msg->ack_clipboard.sequence = sequence;
return 9; return 9;