diff options
Diffstat (limited to 'librpc')
| -rw-r--r-- | librpc/ndr/ndr_string.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/librpc/ndr/ndr_string.c b/librpc/ndr/ndr_string.c index 42ba3cfccc1..cc3508616bb 100644 --- a/librpc/ndr/ndr_string.c +++ b/librpc/ndr/ndr_string.c @@ -588,6 +588,9 @@ _PUBLIC_ enum ndr_err_code ndr_pull_charset(struct ndr_pull *ndr, int ndr_flags, chset = CH_UTF16BE; } + if ((byte_mul != 0) && (length > UINT32_MAX/byte_mul)) { + return ndr_pull_error(ndr, NDR_ERR_BUFSIZE, "length overflow"); + } NDR_PULL_NEED_BYTES(ndr, length*byte_mul); if (!convert_string_talloc(ndr->current_mem_ctx, chset, CH_UNIX, @@ -642,6 +645,9 @@ _PUBLIC_ enum ndr_err_code ndr_push_charset(struct ndr_push *ndr, int ndr_flags, chset = CH_UTF16BE; } + if ((byte_mul != 0) && (length > SIZE_MAX/byte_mul)) { + return ndr_push_error(ndr, NDR_ERR_LENGTH, "length overflow"); + } required = byte_mul * length; NDR_PUSH_NEED_BYTES(ndr, required); |