From 09d04ff881cb9e51faff1139642793ae8c7459b3 Mon Sep 17 00:00:00 2001
From: Pavel Březina <pbrezina@redhat.com>
Date: Mon, 7 Jan 2013 10:34:48 +0100
Subject: memcache: add macro that validates record length

---
 src/responder/nss/nsssrv_mmap_cache.c | 3 +--
 src/util/mmap_cache.h                 | 6 ++++++
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/src/responder/nss/nsssrv_mmap_cache.c b/src/responder/nss/nsssrv_mmap_cache.c
index 16a4bb231..21346e588 100644
--- a/src/responder/nss/nsssrv_mmap_cache.c
+++ b/src/responder/nss/nsssrv_mmap_cache.c
@@ -226,8 +226,7 @@ static bool sss_mc_is_valid_rec(struct sss_mc_ctx *mcc, struct sss_mc_rec *rec)
         return false;
     }
 
-    if ((rec->len == MC_INVALID_VAL32) ||
-        (rec->len > (mcc->dt_size - ((uint8_t *)rec - mcc->data_table)))) {
+    if (!MC_CHECK_RECORD_LENGTH(mcc, rec)) {
         return false;
     }
 
diff --git a/src/util/mmap_cache.h b/src/util/mmap_cache.h
index 407eeea69..1f99c758d 100644
--- a/src/util/mmap_cache.h
+++ b/src/util/mmap_cache.h
@@ -70,6 +70,12 @@ typedef uint32_t rel_ptr_t;
 
 #define MC_VALID_BARRIER(val) (((val) & 0xff000000) == 0xf0000000)
 
+#define MC_CHECK_RECORD_LENGTH(mc_ctx, rec) \
+        ((rec)->len >= MC_HEADER_SIZE && (rec)->len != MC_INVALID_VAL32 \
+         && ((rec)->len <= ((mc_ctx)->dt_size \
+                            - MC_PTR_DIFF(rec, (mc_ctx)->data_table))))
+
+
 #define SSS_MC_MAJOR_VNO    0
 #define SSS_MC_MINOR_VNO    4
 
-- 
cgit