SL-18098 Crash inside unpackBinaryData

2023-11-25 00:17:56 +02:00 · 2023-11-25 00:17:56 +02:00 · 15ea200cfb
parent 6b3dd7929b
commit 15ea200cfb
1 changed files with 7 additions and 0 deletions
--- a/indra/llmessage/lldatapacker.cpp
+++ b/indra/llmessage/lldatapacker.cpp
@ -298,6 +298,13 @@ BOOL LLDataPackerBinaryBuffer::unpackBinaryData(U8 *value, S32 &size, const char
 	}

 	htolememcpy(&size, mCurBufferp, MVT_S32, 4);
+
+    if (size < 0)
+    {
+        LL_WARNS() << "LLDataPackerBinaryBuffer::unpackBinaryData unpacked invalid size, aborting!" << LL_ENDL;
+        return FALSE;
+    }
+
 	mCurBufferp += 4;

 	if (!verifyLength(size, name))