Check some unsanitized network inputs before allocating memory using them.

1 files changed, 8 insertions, 6 deletions

diff --git a/src/tools/dcpomatic_batch.cc b/src/tools/dcpomatic_batch.cc
index dc092bf8c..3114768ac 100644
--- a/src/tools/dcpomatic_batch.cc
+++ b/src/tools/dcpomatic_batch.cc
@@ -402,12 +402,14 @@ public:
 	void handle (shared_ptr<Socket> socket) override
 	{
 		try {
-			int const length = socket->read_uint32 ();
-			scoped_array<char> buffer(new char[length]);
-			socket->read (reinterpret_cast<uint8_t*>(buffer.get()), length);
-			string s (buffer.get());
-			emit(boost::bind(boost::ref(StartJob), s));
-			socket->write (reinterpret_cast<uint8_t const *>("OK"), 3);
+			auto const length = socket->read_uint32();
+			if (length < 65536) {
+				scoped_array<char> buffer(new char[length]);
+				socket->read(reinterpret_cast<uint8_t*>(buffer.get()), length);
+				string s(buffer.get());
+				emit(boost::bind(boost::ref(StartJob), s));
+				socket->write (reinterpret_cast<uint8_t const *>("OK"), 3);
+			}
 		} catch (...) {
 
 		}