fecdec: Add another sanity check to find_group().

[paraslash.git] / fecdec_filter.c

diff --git a/fecdec_filter.c b/fecdec_filter.c
index 794add49ec42d07c04ea826e36f8f77b80a9dad6..5f37f1a81f9199f6080b6669cd455d706a96af06 100644 (file)
--- a/fecdec_filter.c
+++ b/fecdec_filter.c
@@ -117,10 +117,15 @@ static int find_group(struct fec_header *h,
        FOR_EACH_FECDEC_GROUP(fg, pfd) {
                if (fg->h.group_num != h->group_num)
                        continue;
+               if (fg->num_received_slices == 0)
+                       goto success;
                if (fg->h.slices_per_group != h->slices_per_group)
-                       continue;
+                       return -E_BAD_FEC_HEADER;
                if (fg->h.data_slices_per_group != h->data_slices_per_group)
-                       continue;
+                       return -E_BAD_FEC_HEADER;
+               if (fg->h.group_bytes != h->group_bytes)
+                       return -E_BAD_FEC_HEADER;
+success:
                *result = fg;
                return 1;
        }
@@ -161,8 +166,8 @@ static struct fecdec_group *free_oldest_group(struct private_fecdec_data *pfd)
        }
        if (!group_complete(oldest) && !group_empty(oldest))
                PARA_WARNING_LOG("Clearing incomplete group %d "
-                       "(contains %d slices)\n", fg->h.group_num,
-                       fg->num_received_slices);
+                       "(contains %d slices)\n", oldest->h.group_num,
+                       oldest->num_received_slices);
        clear_group(oldest);
        return oldest;
 }
@@ -358,7 +363,7 @@ static ssize_t fecdec(char *buf, size_t len, struct filter_node *fn)
        ret = read_fec_header(buf, len, &h);
        if (ret <= 0)
                return ret;
-       if (h.slice_bytes > fn->bufsize)
+       if (!h.slice_bytes || h.slice_bytes > fn->bufsize)
                return -E_BAD_SLICE_SIZE;
        if (h.slice_num > h.slices_per_group)
                return -E_BAD_SLICE_NUM;
@@ -379,6 +384,7 @@ static void fecdec_close(struct filter_node *fn)
                clear_group(fg);
        free(fn->buf);
        fn->buf = NULL;
+       fec_free(pfd->fec);
        free(fn->private_data);
        fn->private_data = NULL;
 }