Implement custom deserializer to add our own sanity checks

[quassel.git] / src / common / protocols / legacy / legacypeer.cpp

diff --git a/src/common/protocols/legacy/legacypeer.cpp b/src/common/protocols/legacy/legacypeer.cpp
index 2a97641..2a6a776 100644 (file)
--- a/src/common/protocols/legacy/legacypeer.cpp
+++ b/src/common/protocols/legacy/legacypeer.cpp
@@ -23,6 +23,7 @@
 #include <QTcpSocket>
 
 #include "legacypeer.h"
 #include <QTcpSocket>
 
 #include "legacypeer.h"

+#include "serializers/serializers.h"

 
 /* version.inc is no longer used for this */
 const uint protocolVersion = 10;
 
 /* version.inc is no longer used for this */
 const uint protocolVersion = 10;


@@ -62,7 +63,10 @@ void LegacyPeer::processMessage(const QByteArray &msg)
     QVariant item;
     if (_useCompression) {
         QByteArray rawItem;
     QVariant item;
     if (_useCompression) {
         QByteArray rawItem;

-        stream >> rawItem;
+        if (!Serializers::deserialize(stream, rawItem)) {
+            close("Peer sent corrupt data: unable to load QVariant!");
+            return;
+        }

 
         int nbytes = rawItem.size();
         if (nbytes <= 4) {
 
         int nbytes = rawItem.size();
         if (nbytes <= 4) {


@@ -77,10 +81,15 @@ void LegacyPeer::processMessage(const QByteArray &msg)
 
         QDataStream itemStream(&rawItem, QIODevice::ReadOnly);
         itemStream.setVersion(QDataStream::Qt_4_2);
 
         QDataStream itemStream(&rawItem, QIODevice::ReadOnly);
         itemStream.setVersion(QDataStream::Qt_4_2);

-        itemStream >> item;
-    }
-    else {
-        stream >> item;
+        if (!Serializers::deserialize(itemStream, item)) {
+            close("Peer sent corrupt data: unable to load QVariant!");
+            return;
+        }
+    } else {
+        if (!Serializers::deserialize(stream, item)) {
+            close("Peer sent corrupt data: unable to load QVariant!");
+            return;
+        }

     }
 
     if (stream.status() != QDataStream::Ok || !item.isValid()) {
     }
 
     if (stream.status() != QDataStream::Ok || !item.isValid()) {