From eccb872fe87a4c68cfdc36b69d3f5768d6f4ad84 Mon Sep 17 00:00:00 2001 From: mohammed arib Date: Sun, 5 Jul 2026 19:10:12 +0530 Subject: [PATCH] clamp packet length in zyfer_receive to bound a_lastcode --- ntpd/refclock_zyfer.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/ntpd/refclock_zyfer.c b/ntpd/refclock_zyfer.c index 0ec566d5ae..28209b187d 100644 --- a/ntpd/refclock_zyfer.c +++ b/ntpd/refclock_zyfer.c @@ -245,8 +245,14 @@ zyfer_receive( else return; } else { - memcpy(pp->a_lastcode + pp->lencode, p, rbufp->recv_length); - pp->lencode += rbufp->recv_length; + int rlen = rbufp->recv_length; + + /* clamp to the space left in a_lastcode so a long + follow-up packet can not overrun the buffer */ + if (rlen > BMAX - 1 - pp->lencode) + rlen = BMAX - 1 - pp->lencode; + memcpy(pp->a_lastcode + pp->lencode, p, (size_t)rlen); + pp->lencode += rlen; pp->a_lastcode[pp->lencode] = '\0'; }