diff options
| author | Ulrich Drepper <drepper@redhat.com> | 2002-08-02 01:33:11 +0000 |
|---|---|---|
| committer | Ulrich Drepper <drepper@redhat.com> | 2002-08-02 01:33:11 +0000 |
| commit | 12892ded5d913b3c45ea8f22634afd3b273b473d (patch) | |
| tree | d4411a4b7e635925fba051f01f0c238e0f63678c /sunrpc | |
| parent | acbee5f637fe1f2acda89cf2dbddf0d327005dd2 (diff) | |
(xdr_array): Check for overflow on multiplication.
Diffstat (limited to 'sunrpc')
| -rw-r--r-- | sunrpc/xdr_array.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/sunrpc/xdr_array.c b/sunrpc/xdr_array.c index 461a6ad9d8..9f67e7fe62 100644 --- a/sunrpc/xdr_array.c +++ b/sunrpc/xdr_array.c @@ -45,6 +45,7 @@ static char sccsid[] = "@(#)xdr_array.c 1.10 87/08/11 Copyr 1984 Sun Micro"; #include <rpc/types.h> #include <rpc/xdr.h> #include <libintl.h> +#include <limits.h> #ifdef USE_IN_LIBIO # include <wchar.h> @@ -81,7 +82,11 @@ xdr_array (xdrs, addrp, sizep, maxsize, elsize, elproc) return FALSE; } c = *sizep; - if ((c > maxsize) && (xdrs->x_op != XDR_FREE)) + /* + * XXX: Let the overflow possibly happen with XDR_FREE because mem_free() + * doesn't actually use its second argument anyway. + */ + if ((c > maxsize || c > UINT_MAX / elsize) && (xdrs->x_op != XDR_FREE)) { return FALSE; } |