diff options
author | Melanie | 2012-11-17 02:31:56 +0100 |
---|---|---|
committer | Melanie | 2012-11-17 02:31:56 +0100 |
commit | 6faa7fc7f9c47ed4a15a1fdf9a93efab0f163e74 (patch) | |
tree | 5a464d326efd85185e8009b9e4aee26dba021b55 /OpenSim/Region/CoreModules/Agent/AssetTransaction | |
parent | Merge branch 'ubitwork' into avination (diff) | |
download | opensim-SC_OLD-6faa7fc7f9c47ed4a15a1fdf9a93efab0f163e74.zip opensim-SC_OLD-6faa7fc7f9c47ed4a15a1fdf9a93efab0f163e74.tar.gz opensim-SC_OLD-6faa7fc7f9c47ed4a15a1fdf9a93efab0f163e74.tar.bz2 opensim-SC_OLD-6faa7fc7f9c47ed4a15a1fdf9a93efab0f163e74.tar.xz |
Prevent a buffer overflow in asset receiving
Diffstat (limited to 'OpenSim/Region/CoreModules/Agent/AssetTransaction')
-rw-r--r-- | OpenSim/Region/CoreModules/Agent/AssetTransaction/AssetXferUploader.cs | 31 |
1 files changed, 20 insertions, 11 deletions
diff --git a/OpenSim/Region/CoreModules/Agent/AssetTransaction/AssetXferUploader.cs b/OpenSim/Region/CoreModules/Agent/AssetTransaction/AssetXferUploader.cs index 4cedfe6..4b54843 100644 --- a/OpenSim/Region/CoreModules/Agent/AssetTransaction/AssetXferUploader.cs +++ b/OpenSim/Region/CoreModules/Agent/AssetTransaction/AssetXferUploader.cs | |||
@@ -100,18 +100,27 @@ namespace OpenSim.Region.CoreModules.Agent.AssetTransaction | |||
100 | 100 | ||
101 | if (XferID == xferID) | 101 | if (XferID == xferID) |
102 | { | 102 | { |
103 | if (m_asset.Data.Length > 1) | 103 | lock (this) |
104 | { | ||
105 | byte[] destinationArray = new byte[m_asset.Data.Length + data.Length]; | ||
106 | Array.Copy(m_asset.Data, 0, destinationArray, 0, m_asset.Data.Length); | ||
107 | Array.Copy(data, 0, destinationArray, m_asset.Data.Length, data.Length); | ||
108 | m_asset.Data = destinationArray; | ||
109 | } | ||
110 | else | ||
111 | { | 104 | { |
112 | byte[] buffer2 = new byte[data.Length - 4]; | 105 | int assetLength = m_asset.Data.Length; |
113 | Array.Copy(data, 4, buffer2, 0, data.Length - 4); | 106 | int dataLength = data.Length; |
114 | m_asset.Data = buffer2; | 107 | |
108 | if (m_asset.Data.Length > 1) | ||
109 | { | ||
110 | byte[] destinationArray = new byte[assetLength + dataLength]; | ||
111 | Array.Copy(m_asset.Data, 0, destinationArray, 0, assetLength); | ||
112 | Array.Copy(data, 0, destinationArray, assetLength, dataLength); | ||
113 | m_asset.Data = destinationArray; | ||
114 | } | ||
115 | else | ||
116 | { | ||
117 | if (dataLength > 4) | ||
118 | { | ||
119 | byte[] buffer2 = new byte[dataLength - 4]; | ||
120 | Array.Copy(data, 4, buffer2, 0, dataLength - 4); | ||
121 | m_asset.Data = buffer2; | ||
122 | } | ||
123 | } | ||
115 | } | 124 | } |
116 | 125 | ||
117 | ourClient.SendConfirmXfer(xferID, packetID); | 126 | ourClient.SendConfirmXfer(xferID, packetID); |