Bug 4201 - No checks on the encapsulation size

4 files changed, 8 insertions, 25 deletions

diff --git a/cpp/src/Ice/BasicStream.cpp b/cpp/src/Ice/BasicStream.cpp
index 9b0f6c560f6..779cc2db7f4 100644
--- a/cpp/src/Ice/BasicStream.cpp
+++ b/cpp/src/Ice/BasicStream.cpp
@@ -325,9 +325,9 @@ IceInternal::BasicStream::skipEncaps()
 {
     Int sz;
     read(sz);
-    if(sz < 0)
+    if(sz < 6)
     {
-        throw NegativeSizeException(__FILE__, __LINE__);
+        throw UnmarshalOutOfBoundsException(__FILE__, __LINE__);
     }
     if(i - sizeof(Int) + sz > b.end())
     {
@@ -368,9 +368,9 @@ IceInternal::BasicStream::startReadSlice()
 {
     Int sz;
     read(sz);
-    if(sz < 0)
+    if(sz < 4)
     {
-        throw NegativeSizeException(__FILE__, __LINE__);
+        throw UnmarshalOutOfBoundsException(__FILE__, __LINE__);
     }
     _readSlice = i - b.begin();
 }
@@ -385,9 +385,9 @@ IceInternal::BasicStream::skipSlice()
 {
     Int sz;
     read(sz);
-    if(sz < 0)
+    if(sz < 4)
     {
-        throw NegativeSizeException(__FILE__, __LINE__);
+        throw UnmarshalOutOfBoundsException(__FILE__, __LINE__);
     }
     i += sz - sizeof(Int);
     if(i > b.end())
@@ -2124,12 +2124,6 @@ IceInternal::BasicStream::throwUnmarshalOutOfBoundsException(const char* file, i
 }
 
 void
-IceInternal::BasicStream::throwNegativeSizeException(const char* file, int line)
-{
-    throw NegativeSizeException(file, line);
-}
-
-void
 IceInternal::BasicStream::throwUnsupportedEncodingException(const char* file, int line, Byte eMajor, Byte eMinor)
 {   
     UnsupportedEncodingException ex(file, line);
diff --git a/cpp/src/Ice/ConnectionI.cpp b/cpp/src/Ice/ConnectionI.cpp
index 9db70725047..6fc70a46dd4 100644
--- a/cpp/src/Ice/ConnectionI.cpp
+++ b/cpp/src/Ice/ConnectionI.cpp
@@ -2286,7 +2286,7 @@ Ice::ConnectionI::parseMessage(BasicStream& stream, Int& invokeNum, Int& request
                     if(invokeNum < 0)
                     {
                         invokeNum = 0;
-                        throw NegativeSizeException(__FILE__, __LINE__);
+                        throw UnmarshalOutOfBoundsException(__FILE__, __LINE__);
                     }
                     servantManager = _servantManager;
                     adapter = _adapter;
diff --git a/cpp/src/Ice/Exception.cpp b/cpp/src/Ice/Exception.cpp
index 40d923d97fe..1922769266b 100644
--- a/cpp/src/Ice/Exception.cpp
+++ b/cpp/src/Ice/Exception.cpp
@@ -617,17 +617,6 @@ Ice::EncapsulationException::ice_print(ostream& out) const
 }
 
 void
-Ice::NegativeSizeException::ice_print(ostream& out) const
-{
-    Exception::ice_print(out);
-    out << ":\nprotocol error: negative size for sequence, dictionary, etc.";
-    if(!reason.empty())
-    {
-        out << ":\n" << reason;
-    }
-}
-
-void
 Ice::PluginInitializationException::ice_print(ostream& out) const
 {
     Exception::ice_print(out);
diff --git a/cpp/src/Ice/StreamI.cpp b/cpp/src/Ice/StreamI.cpp
index 0fe3b566473..8a333dbccc5 100644
--- a/cpp/src/Ice/StreamI.cpp
+++ b/cpp/src/Ice/StreamI.cpp
@@ -602,7 +602,7 @@ Ice::OutputStreamI::writeSize(Int sz)
 {
     if(sz < 0)
     {
-        throw NegativeSizeException(__FILE__, __LINE__);
+        throw MarshalException(__FILE__, __LINE__);
     }
 
     _os->writeSize(sz);