aboutsummaryrefslogtreecommitdiff
path: root/sunrpc
diff options
context:
space:
mode:
authorUlrich Drepper <drepper@redhat.com>2002-08-02 01:33:11 +0000
committerUlrich Drepper <drepper@redhat.com>2002-08-02 01:33:11 +0000
commit12892ded5d913b3c45ea8f22634afd3b273b473d (patch)
treed4411a4b7e635925fba051f01f0c238e0f63678c /sunrpc
parentacbee5f637fe1f2acda89cf2dbddf0d327005dd2 (diff)
downloadglibc-12892ded5d913b3c45ea8f22634afd3b273b473d.zip
glibc-12892ded5d913b3c45ea8f22634afd3b273b473d.tar.gz
glibc-12892ded5d913b3c45ea8f22634afd3b273b473d.tar.bz2
(xdr_array): Check for overflow on multiplication.
Diffstat (limited to 'sunrpc')
-rw-r--r--sunrpc/xdr_array.c7
1 files changed, 6 insertions, 1 deletions
diff --git a/sunrpc/xdr_array.c b/sunrpc/xdr_array.c
index 461a6ad..9f67e7f 100644
--- a/sunrpc/xdr_array.c
+++ b/sunrpc/xdr_array.c
@@ -45,6 +45,7 @@ static char sccsid[] = "@(#)xdr_array.c 1.10 87/08/11 Copyr 1984 Sun Micro";
#include <rpc/types.h>
#include <rpc/xdr.h>
#include <libintl.h>
+#include <limits.h>
#ifdef USE_IN_LIBIO
# include <wchar.h>
@@ -81,7 +82,11 @@ xdr_array (xdrs, addrp, sizep, maxsize, elsize, elproc)
return FALSE;
}
c = *sizep;
- if ((c > maxsize) && (xdrs->x_op != XDR_FREE))
+ /*
+ * XXX: Let the overflow possibly happen with XDR_FREE because mem_free()
+ * doesn't actually use its second argument anyway.
+ */
+ if ((c > maxsize || c > UINT_MAX / elsize) && (xdrs->x_op != XDR_FREE))
{
return FALSE;
}