common: Add mandatory length field to UDP receive calls

Current UDP receive reads up to MAX_UDP_LENGTH bytes into the
passed in buffer, which may lead to buffer overflow if the
write buffer is of insufficient size.

Add mandatory length argument to UDP socket receive calls.

Reported-by: Simone Margaritelli <simone@zimperium.com>
Signed-off-by: Tom Tsou <tom.tsou@ettus.com>

1 files changed, 9 insertions, 13 deletions

diff --git a/CommonLibs/Sockets.cpp b/CommonLibs/Sockets.cpp
index c502a78..9030a86 100644
--- a/CommonLibs/Sockets.cpp
+++ b/CommonLibs/Sockets.cpp
@@ -187,24 +187,20 @@ int DatagramSocket::send(const struct sockaddr* dest, const char * message)
 	return send(dest,message,length);
 }
 
-
-
-
-
-int DatagramSocket::read(char* buffer)
+int DatagramSocket::read(char* buffer, size_t length)
 {
-	socklen_t temp_len = sizeof(mSource);
-	int length = recvfrom(mSocketFD, (void*)buffer, MAX_UDP_LENGTH, 0,
-	    (struct sockaddr*)&mSource,&temp_len);
-	if ((length==-1) && (errno!=EAGAIN)) {
+	socklen_t addr_len = sizeof(mSource);
+	int rd_length = recvfrom(mSocketFD, (void *) buffer, length, 0,
+		(struct sockaddr*) &mSource, &addr_len);
+
+	if ((rd_length==-1) && (errno!=EAGAIN)) {
 		perror("DatagramSocket::read() failed");
 		throw SocketError();
 	}
-	return length;
+	return rd_length;
 }
 
-
-int DatagramSocket::read(char* buffer, unsigned timeout)
+int DatagramSocket::read(char* buffer, size_t length, unsigned timeout)
 {
 	fd_set fds;
 	FD_ZERO(&fds);
@@ -218,7 +214,7 @@ int DatagramSocket::read(char* buffer, unsigned timeout)
 		throw SocketError();
 	}
 	if (sel==0) return -1;
-	if (FD_ISSET(mSocketFD,&fds)) return read(buffer);
+	if (FD_ISSET(mSocketFD,&fds)) return read(buffer, length);
 	return -1;
 }