Check for overflow the right way.

1 files changed, 3 insertions, 4 deletions

diff --git a/xattrs.c b/xattrs.c
index b10c2567..bcb4bcac 100644
--- a/xattrs.c
+++ b/xattrs.c
@@ -199,7 +199,7 @@ static char *get_xattr_data(const char *fname, const char *name, size_t *len_ptr
 
 	if (!datum_len && !extra_len)
 		extra_len = 1; /* request non-zero amount of memory */
-	if (datum_len + extra_len < datum_len)
+	if (SIZE_MAX - datum_len < extra_len)
 		overflow_exit("get_xattr_data");
 	ptr = new_array(char, datum_len + extra_len);
 
@@ -748,7 +748,7 @@ int recv_xattr_request(struct file_struct *file, int f_in)
 		old_datum = rxa->datum;
 		rxa->datum_len = read_varint(f_in);
 
-		if (rxa->name_len + rxa->datum_len < rxa->name_len)
+		if (SIZE_MAX - rxa->name_len < rxa->datum_len)
 			overflow_exit("recv_xattr_request");
 		rxa->datum = new_array(char, rxa->datum_len + rxa->name_len);
 		name = rxa->datum + rxa->datum_len;
@@ -799,8 +799,7 @@ void receive_xattr(int f, struct file_struct *file)
 		size_t datum_len = read_varint(f);
 		size_t dget_len = datum_len > MAX_FULL_DATUM ? 1 + MAX_DIGEST_LEN : datum_len;
 		size_t extra_len = MIGHT_NEED_RPRE ? RPRE_LEN : 0;
-		if ((dget_len + extra_len < dget_len)
-		 || (dget_len + extra_len + name_len < dget_len + extra_len))
+		if (SIZE_MAX - dget_len < extra_len || SIZE_MAX - dget_len - extra_len < name_len)
 			overflow_exit("receive_xattr");
 		ptr = new_array(char, dget_len + extra_len + name_len);
 		name = ptr + dget_len + extra_len;