memcached: fix invalid read on short packet

ntop · Apr 6, 2019 · 74715b1 · 74715b1
1 parent a455e0d
commit 74715b1
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/src/lib/protocols/memcached.c b/src/lib/protocols/memcached.c
@@ -89,7 +89,7 @@
 
 #define MEMCACHED_MIN_MATCH     2 /* Minimum number of command/responses required */
 
-#define MEMCACHED_MATCH(cr)     memcmp(offset, cr, cr ## _LEN)
+#define MEMCACHED_MATCH(cr)     (cr ## _LEN > length || memcmp(offset, cr, cr ## _LEN))
 
 static void ndpi_int_memcached_add_connection(struct ndpi_detection_module_struct
         *ndpi_struct, struct ndpi_flow_struct *flow)
@@ -105,6 +105,7 @@ void ndpi_search_memcached(
 {
     struct ndpi_packet_struct *packet = &flow->packet;
     const u_int8_t *offset = packet->payload;
+    const u_int16_t length = packet->payload_packet_len;
     u_int8_t *matches;
 
     NDPI_LOG_DBG(ndpi_struct, "search memcached\n");