From a0d9b6a7e08ca824091c0e97d3823fb0ca3626a0 Mon Sep 17 00:00:00 2001 From: "Sergio R. Caprile" Date: Tue, 28 Jan 2025 10:24:59 -0300 Subject: [PATCH] fix UB and possible HF trigger --- mongoose.c | 3 ++- src/net_builtin.c | 2 +- src/tls_builtin.c | 1 + 3 files changed, 4 insertions(+), 2 deletions(-) diff --git a/mongoose.c b/mongoose.c index 8717b6b1..b7297b3f 100644 --- a/mongoose.c +++ b/mongoose.c @@ -4731,7 +4731,7 @@ static void handle_tls_recv(struct mg_connection *c) { mg_error(c, "oom"); } else { // Decrypt data directly into c->recv - long n = mg_tls_recv(c, &io->buf[io->len], io->size - io->len); + long n = mg_tls_recv(c, io->buf != NULL ? &io->buf[io->len] : io->buf, io->size - io->len); if (n == MG_IO_ERR) { mg_error(c, "TLS recv error"); } else if (n > 0) { @@ -11341,6 +11341,7 @@ long mg_tls_recv(struct mg_connection *c, void *buf, size_t len) { mg_tls_drop_record(c); return MG_IO_WAIT; } + if (buf == NULL || len == 0) return 0L; minlen = len < tls->recv_len ? len : tls->recv_len; memmove(buf, recv_buf, minlen); tls->recv_offset += minlen; diff --git a/src/net_builtin.c b/src/net_builtin.c index 964681f6..c9038211 100644 --- a/src/net_builtin.c +++ b/src/net_builtin.c @@ -651,7 +651,7 @@ static void handle_tls_recv(struct mg_connection *c) { mg_error(c, "oom"); } else { // Decrypt data directly into c->recv - long n = mg_tls_recv(c, &io->buf[io->len], io->size - io->len); + long n = mg_tls_recv(c, io->buf != NULL ? &io->buf[io->len] : io->buf, io->size - io->len); if (n == MG_IO_ERR) { mg_error(c, "TLS recv error"); } else if (n > 0) { diff --git a/src/tls_builtin.c b/src/tls_builtin.c index 6ad48a90..6eb5a1df 100644 --- a/src/tls_builtin.c +++ b/src/tls_builtin.c @@ -1380,6 +1380,7 @@ long mg_tls_recv(struct mg_connection *c, void *buf, size_t len) { mg_tls_drop_record(c); return MG_IO_WAIT; } + if (buf == NULL || len == 0) return 0L; minlen = len < tls->recv_len ? len : tls->recv_len; memmove(buf, recv_buf, minlen); tls->recv_offset += minlen;