diff options
| author | Stefan Metzmacher <metze@samba.org> | 2013-10-16 14:17:49 +0200 |
|---|---|---|
| committer | Karolin Seeger <kseeger@samba.org> | 2013-12-09 07:05:45 +0100 |
| commit | 6e293891ca8048424e7a95a43b62035733c716c2 (patch) | |
| tree | 7fb8bcd21e50ef212220369e9bfdba1d6819770a /source3/lib | |
| parent | 94b2641a530b3bd6bb67017c2a3c571f0ff41921 (diff) | |
| download | samba-6e293891ca8048424e7a95a43b62035733c716c2.tar.gz samba-6e293891ca8048424e7a95a43b62035733c716c2.tar.xz samba-6e293891ca8048424e7a95a43b62035733c716c2.zip | |
CVE-2013-4408:s3:util_tsock: add some overflow detection to tstream_read_packet_done()
Bug: https://bugzilla.samba.org/show_bug.cgi?id=10185
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Diffstat (limited to 'source3/lib')
| -rw-r--r-- | source3/lib/util_tsock.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/source3/lib/util_tsock.c b/source3/lib/util_tsock.c index 35a97f5e692..03380ef244b 100644 --- a/source3/lib/util_tsock.c +++ b/source3/lib/util_tsock.c @@ -110,6 +110,11 @@ static void tstream_read_packet_done(struct tevent_req *subreq) return; } + if (total + more < total) { + tevent_req_error(req, EMSGSIZE); + return; + } + tmp = talloc_realloc(state, state->buf, uint8_t, total+more); if (tevent_req_nomem(tmp, req)) { return; |