diff --git a/src/debugger/handler_dbgp.c b/src/debugger/handler_dbgp.c index c6fadffa..c687132f 100644 --- a/src/debugger/handler_dbgp.c +++ b/src/debugger/handler_dbgp.c @@ -2434,6 +2434,7 @@ static int xdebug_dbgp_parse_option(xdebug_con *context, char* line, int flags, ** Handlers for debug functions */ #define READ_BUFFER_SIZE 128 +#define XDEBUG_DBGP_MAX_PACKET (64 * 1024 * 1024) #define FD_RL_FILE 0 #define FD_RL_SOCKET 1 @@ -2460,7 +2461,22 @@ static char* xdebug_fd_read_line_delim(int socketfd, fd_buf *context, int type, newl = recv(socketfd, buffer, READ_BUFFER_SIZE, 0); } if (newl > 0) { - context->buffer = realloc(context->buffer, context->buffer_size + newl + 1); + char *new_buffer; + + if (context->buffer_size > XDEBUG_DBGP_MAX_PACKET - newl - 1) { + free(context->buffer); + context->buffer = NULL; + context->buffer_size = 0; + return NULL; + } + new_buffer = realloc(context->buffer, context->buffer_size + newl + 1); + if (!new_buffer) { + free(context->buffer); + context->buffer = NULL; + context->buffer_size = 0; + return NULL; + } + context->buffer = new_buffer; memcpy(context->buffer + context->buffer_size, buffer, newl); context->buffer_size += newl; context->buffer[context->buffer_size] = '\0';