diff --git a/modules/channel/chain/dap_stream_ch_chain.c b/modules/channel/chain/dap_stream_ch_chain.c index 94eb3671fb10d8780d4c19d40931774bbe8e9d22..54fa329850fd2e1e4c4f2bf074db5fba0bd2ee1c 100644 --- a/modules/channel/chain/dap_stream_ch_chain.c +++ b/modules/channel/chain/dap_stream_ch_chain.c @@ -666,10 +666,24 @@ static bool s_gdb_in_pkt_proc_callback(dap_proc_thread_t *a_thread, void *a_arg) struct sync_request *l_sync_request = (struct sync_request *) a_arg; dap_chain_pkt_item_t *l_pkt_item = &l_sync_request->pkt; - if (l_pkt_item->pkt_data_size) { + if(l_pkt_item->pkt_data_size >= sizeof(dap_store_obj_pkt_t)) { + + // Validate size of received packet + dap_store_obj_pkt_t *l_obj_pkt = (dap_store_obj_pkt_t*)l_pkt_item->pkt_data; + size_t l_obj_pkt_size = l_obj_pkt ? l_obj_pkt->data_size + sizeof(dap_store_obj_pkt_t) : 0; + if(l_pkt_item->pkt_data_size != l_obj_pkt_size) { + log_it(L_WARNING, "In: s_gdb_in_pkt_proc_callback: received size=%zu is not equal to obj_pkt_size=%zu", + l_pkt_item->pkt_data_size, l_obj_pkt_size); + if(l_pkt_item->pkt_data) { + DAP_DELETE(l_pkt_item->pkt_data); + } + DAP_DELETE(l_sync_request); + return true; + } + size_t l_data_obj_count = 0; // deserialize data & Parse data from dap_db_log_pack() - dap_store_obj_t *l_store_obj = dap_store_unpacket_multiple((dap_store_obj_pkt_t *)l_pkt_item->pkt_data, &l_data_obj_count); + dap_store_obj_t *l_store_obj = dap_store_unpacket_multiple(l_obj_pkt, &l_data_obj_count); if (s_debug_more){ if (l_data_obj_count) log_it(L_INFO, "In: GLOBAL_DB parse: pkt_data_size=%"DAP_UINT64_FORMAT_U", l_data_obj_count = %zu",l_pkt_item->pkt_data_size, l_data_obj_count );