From f2f363b6aac12837120e7b4f0d6ad6b5849c08d4 Mon Sep 17 00:00:00 2001 From: joseph calderon Date: Sun, 31 May 2026 09:24:29 -0700 Subject: [PATCH] Fix uninitialized memory read vulnerability in packet validation --- src/common/normMessage.cpp | 2 +- wscript | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/common/normMessage.cpp b/src/common/normMessage.cpp index 48352a3..4a01e09 100755 --- a/src/common/normMessage.cpp +++ b/src/common/normMessage.cpp @@ -79,7 +79,7 @@ bool NormMsg::InitFromBuffer(UINT16 msgLength) PLOG(PL_FATAL, "NormMsg::InitFromBuffer() invalid message type!\n"); return false; } - if (msgLength < header_length) + if ((msgLength < header_length) || (header_length < header_length_base)) { PLOG(PL_FATAL, "NormMsg::InitFromBuffer() invalid message or header length\n"); return false; diff --git a/wscript b/wscript index 46965d1..2e21b07 100755 --- a/wscript +++ b/wscript @@ -47,7 +47,7 @@ system = platform.system().lower() def options(ctx): ctx.recurse('protolib') - build_opts = ctx.parser.add_argument_group('Compile/install Options', 'Use during build/install step.') + build_opts = ctx.add_option_group('Compile/install Options', 'Use during build/install step.') # Add Rust binding options ctx.add_option('--build-rust', action='store_true', default=False,