Zbigniew Jędrzejewski-Szmek e0c17a7d1b bus-message: fix negative offset with ~empty message ...

In the linked reproducer, m->fields_size == 0, and we calculate ri == -1, which
of course doesn't end well. Skip the whole calculation if m->fields_size == 0,
and also check that we don't go negative even if it is non-zero.

Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19446 and #15583.

2020-05-20 09:33:54 +02:00

17 B

Raw History

View Raw