sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-26 10:04:02 +03:00
Code

util/charset/convert: do not overflow dest len

Browse Source 
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
This commit is contained in:
Douglas Bagnall 2019-05-10 17:07:43 +12:00 committed by Andrew Bartlett
parent 09355b7855
commit 265b3b0c6c
1 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
lib/util/charset/convert_string.c
View File

@ -349,7 +349,7 @@ bool convert_string_talloc_handle(TALLOC_CTX *ctx, struct smb_iconv_handle *ic,
size_t *converted_size)
{
size_t i_len, o_len, destlen = (srclen * 3) / 2;
size_t i_len, o_len, destlen;
size_t retval;
const char *inbuf = (const char *)src;
char *outbuf = NULL, *ob = NULL;
@ -397,6 +397,15 @@ bool convert_string_talloc_handle(TALLOC_CTX *ctx, struct smb_iconv_handle *ic,
return false;
}
if (srclen >= SIZE_MAX / 3) {
DBG_ERR("convert_string_talloc: "
"srclen is %zu, destlen would wrap!\n",
srclen);
errno = EOPNOTSUPP;
return false;
}
destlen = srclen * 3 / 2;
convert:
/* +2 is for ucs2 null termination. */