AuroraMiddleware/glibc
1
0
Fork 0
mirror of https://sourceware.org/git/glibc.git synced 2025-01-03 00:10:10 +00:00
Code Issues Packages Projects Releases Wiki Activity

(xdr_array): Check for overflow on multiplication.

Browse Source
This commit is contained in:
Ulrich Drepper 2002-08-02 01:33:11 +00:00
parent acbee5f637
commit 12892ded5d
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
sunrpc/xdr_array.c
View File

@ -45,6 +45,7 @@ static char sccsid[] = "@(#)xdr_array.c 1.10 87/08/11 Copyr 1984 Sun Micro";
#include <rpc/types.h> #include <rpc/types.h>
#include <rpc/xdr.h> #include <rpc/xdr.h>
#include <libintl.h> #include <libintl.h>
#include <limits.h>
#ifdef USE_IN_LIBIO #ifdef USE_IN_LIBIO
# include <wchar.h> # include <wchar.h>
@ -81,7 +82,11 @@ xdr_array (xdrs, addrp, sizep, maxsize, elsize, elproc)
return FALSE; return FALSE;
} }
c = *sizep; c = *sizep;
if ((c > maxsize) && (xdrs->x_op != XDR_FREE)) /*
* XXX: Let the overflow possibly happen with XDR_FREE because mem_free()
* doesn't actually use its second argument anyway.
*/
if ((c > maxsize || c > UINT_MAX / elsize) && (xdrs->x_op != XDR_FREE))
{ {
return FALSE; return FALSE;
} }