From 7c456a1652b9915c625cfcfd7f02d8d39c44940f Mon Sep 17 00:00:00 2001 From: Evgeny Date: Mon, 8 Jun 2026 17:23:20 +0300 Subject: [PATCH] =?UTF-8?q?proxy:=20bounds=20check=20data=5Flen=20=D0=BF?= =?UTF-8?q?=D0=B5=D1=80=D0=B5=D0=B4=20memcpy=20=D0=B2=20handle=5Fdata=20?= =?UTF-8?q?=E2=80=94=20fix=20buffer=20overflow?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- src/proxy/tcp_proxy_server.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/proxy/tcp_proxy_server.c b/src/proxy/tcp_proxy_server.c index 0fb5c954..cc217629 100644 --- a/src/proxy/tcp_proxy_server.c +++ b/src/proxy/tcp_proxy_server.c @@ -326,6 +326,11 @@ int tcp_proxy_server_handle_data(struct UTUN_INSTANCE* inst, struct ETCP_CONN* c } size_t data_len = entry->len - TCP_PROXY_HDR_SIZE; if (data_len > 0) { + if (data_len > rc->tc->data_pool->object_size) { + DEBUG_ERROR(DEBUG_CATEGORY_SOCKET, "tcp_proxy_server: data_len=%zu > pool_sz=%zu, dropping sid=%08x", + data_len, rc->tc->data_pool->object_size, stream_id); + queue_dgram_free(entry); queue_entry_free(entry); return -1; + } struct ll_entry* e = queue_entry_new_from_pool(rc->tc->entry_pool); uint8_t* buf = memory_pool_alloc(rc->tc->data_pool); if (e && buf) {