mirror of
https://github.com/savoirfairelinux/opendht.git
synced 2026-11-08 12:28:42 +00:00
Cyrille BéraudandCopilot
b7d4cf35d0
An error array was read at index 0 without checking its size, so a packet carrying "e":[] dereferenced a null element pointer and crashed the process on unauthenticated UDP input. When a message had an error array but no "a", "r" or "u" map, the same object was then walked through the map view of the msgpack union. A two-element array appeared to hold two key/value pairs, reading past its allocation. A request field that was not a map was never type-checked either. Validate the error array size, restrict request parsing to "a", "r" and "u", and require those to be maps. Add parser regressions for the empty error array, the error-only message and the non-map request; the first one segfaults without this change. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>