current/SOURCES/freeciv-2.3.2-CVE-2012-5645.patch

--- trunk/common/packets.c      2012/07/31 22:29:54     21669
+++ trunk/common/packets.c      2012/07/31 22:41:50     21670
@@ -339,7 +339,7 @@
 return a NULL packet even if everything is OK (receive_packet_goto_route).
 **************************************************************************/
 void *get_packet_from_connection(struct connection *pc,
-                                enum packet_type *ptype, bool * presult)
+                                enum packet_type *ptype, bool *presult)
 {
   int len_read;
   int whole_packet_len;
@@ -396,6 +396,14 @@
     return NULL;               /* not all data has been read */
   }
 
+  if (whole_packet_len < header_size) {
+    log_verbose("The packet size is reported to be less than header alone. "
+                "The connection will be closed now.");
+    connection_close(pc, _("illegal packet size"));
+
+    return NULL;
+  }
+
 #ifdef USE_COMPRESSION
   if (compressed_packet) {
     uLong compressed_size = whole_packet_len - header_size;
1	--- trunk/common/packets.c 2012/07/31 22:29:54 21669
2	+++ trunk/common/packets.c 2012/07/31 22:41:50 21670
3	@@ -339,7 +339,7 @@
4	return a NULL packet even if everything is OK (receive_packet_goto_route).
5	**************************************************************************/
6	void get_packet_from_connection(struct connection pc,
7	- enum packet_type ptype, bool presult)
8	+ enum packet_type ptype, bool presult)
9	{
10	int len_read;
11	int whole_packet_len;
12	@@ -396,6 +396,14 @@
13	return NULL; /* not all data has been read */
14	}
15
16	+ if (whole_packet_len < header_size) {
17	+ log_verbose("The packet size is reported to be less than header alone. "
18	+ "The connection will be closed now.");
19	+ connection_close(pc, _("illegal packet size"));
20	+
21	+ return NULL;
22	+ }
23	+
24	#ifdef USE_COMPRESSION
25	if (compressed_packet) {
26	uLong compressed_size = whole_packet_len - header_size;