summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorNikolai Kondrashov <Nikolai.Kondrashov@redhat.com>2016-07-07 12:48:42 +0300
committerLukas Slebodnik <lslebodn@redhat.com>2016-07-07 12:52:01 +0200
commit740bfe1a5bf519de8e13bdce5c4143b0f24d7433 (patch)
tree0d49860a3f1d213e312bb0a4d53ff44d251fa6e4
parent78027feeb56d6fe216f699be86a4716aaef3f628 (diff)
downloadsssd-740bfe1a5bf519de8e13bdce5c4143b0f24d7433.zip
sssd-740bfe1a5bf519de8e13bdce5c4143b0f24d7433.tar.gz
sssd-740bfe1a5bf519de8e13bdce5c4143b0f24d7433.tar.xz
Fix packet size calculation in sss_packet_new
Use division instead of modulo while rounding the created packet size up to a multiple of SSSSRV_PACKET_MEM_SIZE in sss_packet_new. This fixes potentially packet buffer overflows with certain body sizes. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
-rw-r--r--src/responder/common/responder_packet.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/src/responder/common/responder_packet.c b/src/responder/common/responder_packet.c
index 1a201c1..4f5e110 100644
--- a/src/responder/common/responder_packet.c
+++ b/src/responder/common/responder_packet.c
@@ -75,7 +75,7 @@ int sss_packet_new(TALLOC_CTX *mem_ctx, size_t size,
if (!packet) return ENOMEM;
if (size) {
- int n = (size + SSS_NSS_HEADER_SIZE) % SSSSRV_PACKET_MEM_SIZE;
+ int n = (size + SSS_NSS_HEADER_SIZE) / SSSSRV_PACKET_MEM_SIZE;
packet->memsize = (n + 1) * SSSSRV_PACKET_MEM_SIZE;
} else {
packet->memsize = SSSSRV_PACKET_MEM_SIZE;