ubusd: protect against too-short messages

[project/ubus.git] / ubusd_main.c

diff --git a/ubusd_main.c b/ubusd_main.c
index d298b51db17b5ccd35255a5f89877a6db781d67f..4ea5245f2fa0434c51d1896bac3444ba47a902a4 100644 (file)
--- a/ubusd_main.c
+++ b/ubusd_main.c
@@ -115,6 +115,8 @@ retry:
                if (cl->pending_msg_offset < (int) sizeof(cl->hdrbuf))
                        goto out;
 
+               if (blob_raw_len(&cl->hdrbuf.data) < sizeof(struct blob_attr))
+                       goto disconnect;
                if (blob_pad_len(&cl->hdrbuf.data) > UBUS_MAX_MSGLEN)
                        goto disconnect;