diff options
| author | Jeremy Allison <jra@samba.org> | 2016-11-30 09:19:43 -0800 |
|---|---|---|
| committer | Jeremy Allison <jra@samba.org> | 2016-12-01 02:02:19 +0100 |
| commit | d2fe23ae0a66d781b97ec362bb1524b7c31e38b8 (patch) | |
| tree | 6aac9db5a046bba5e90559d7f4517759ea315ad4 /librpc | |
| parent | 737599268fb8959c83fe50158fe1ea3d8c2f0603 (diff) | |
| download | samba-d2fe23ae0a66d781b97ec362bb1524b7c31e38b8.tar.gz | |
librpc: cab: Integer wrap protection for ndr_count_cfdata().
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Diffstat (limited to 'librpc')
| -rw-r--r-- | librpc/ndr/ndr_cab.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/librpc/ndr/ndr_cab.c b/librpc/ndr/ndr_cab.c index 0d2b36b3249..d5ab87fb0af 100644 --- a/librpc/ndr/ndr_cab.c +++ b/librpc/ndr/ndr_cab.c @@ -57,6 +57,10 @@ uint32_t ndr_count_cfdata(const struct cab_file *r) uint32_t count = 0, i; for (i = 0; i < r->cfheader.cFolders; i++) { + if (count + r->cffolders[i].cCFData < count) { + /* Integer wrap. */ + return 0; + } count += r->cffolders[i].cCFData; } |