DGNum/rpcd
6
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

session: ignore non-string username attribute upon restore

Browse source 
When restoring session information from blob data, only consider the
embedded username attribute if it is a string value.

Other types may cause invalid memory accesses when attempting to strcmp()
the attribute value.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
This commit is contained in:
Jo-Philipp Wich 2018-03-15 12:22:34 +01:00
parent 3d400c723b
commit eb09f3a3fd
1 changed files with 3 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
session.c
View file

@ -1288,6 +1288,9 @@ rpc_session_from_blob(struct uci_context *uci, struct blob_attr *attr)
blobmsg_for_each_attr(data, tb[RPC_DUMP_DATA], rem) {
rpc_session_set(ses, data);
if (blobmsg_type(data) != BLOBMSG_TYPE_STRING)
continue;
if (!strcmp(blobmsg_name(data), "username"))
user = blobmsg_get_string(data);
}