From 0ae4882ada3f8c84cb1d4b9f550871c3964de5e2 Mon Sep 17 00:00:00 2001 From: Levi Neely <141506390+lneely@users.noreply.github.com> Date: Tue, 3 Mar 2026 15:46:39 +0100 Subject: [PATCH] Fix integer overflow in prpc.c response->length calculation (#321) RPC commands tested, daemon works --- pclsync/prpc.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/pclsync/prpc.c b/pclsync/prpc.c index 49556bd..6b953fe 100644 --- a/pclsync/prpc.c +++ b/pclsync/prpc.c @@ -219,12 +219,12 @@ static void respond(rpc_message_t *request, rpc_message_t *response) { // truncate messages that exceed the buffer boundaries size_t value_length = strnlen(response->value, value_avail); - response->length = sizeof(rpc_message_t) + value_length + 1; - if (response->length > POVERLAY_BUFSIZE) { - response->length = POVERLAY_BUFSIZE; - response->value[value_avail - 1] = '\0'; + if (value_length > POVERLAY_BUFSIZE - sizeof(rpc_message_t) - 1) { + value_length = POVERLAY_BUFSIZE - sizeof(rpc_message_t) - 1; + response->value[value_length] = '\0'; pdbg_logf(D_WARNING, "Response message truncated to fit buffer"); } + response->length = sizeof(rpc_message_t) + value_length + 1; } void prpc_main_loop() {