Merge pull request #5690 from neheb/bzero

[thirdparty/cups.git] / cups / snmp.c

diff --git a/cups/snmp.c b/cups/snmp.c
index 5cefee454159c8162282b47dd15a4938040c6106..6da119d7679d6c37863f8954e4fb7d18e0767d17 100644 (file)
--- a/cups/snmp.c
+++ b/cups/snmp.c
@@ -1,7 +1,7 @@
 /*
  * SNMP functions for CUPS.
  *
- * Copyright © 2007-2014 by Apple Inc.
+ * Copyright © 2007-2019 by Apple Inc.
  * Copyright © 2006-2007 by Easy Software Products, all rights reserved.
  *
  * Licensed under Apache License v2.0.  See the file "LICENSE" for more
@@ -1167,7 +1167,7 @@ asn1_encode_snmp(unsigned char *buffer,   /* I - Buffer */
   memcpy(bufptr, packet->community, commlen);
   bufptr += commlen;
 
-  *bufptr++ = packet->request_type;    /* Get-Request-PDU/Get-Next-Request-PDU */
+  *bufptr++ = (unsigned char)packet->request_type;     /* Get-Request-PDU/Get-Next-Request-PDU */
   asn1_set_length(&bufptr, reqlen);
 
   asn1_set_integer(&bufptr, (int)packet->request_id);
@@ -1233,6 +1233,9 @@ asn1_get_integer(
   int  value;                          /* Integer value */
 
 
+  if (*buffer >= bufend)
+    return (0);
+
   if (length > sizeof(int))
   {
     (*buffer) += length;
@@ -1259,6 +1262,9 @@ asn1_get_length(unsigned char **buffer,   /* IO - Pointer in buffer */
   unsigned     length;                 /* Length */
 
 
+  if (*buffer >= bufend)
+    return (0);
+
   length = **buffer;
   (*buffer) ++;
 
@@ -1301,6 +1307,9 @@ asn1_get_oid(
   int          number;                 /* OID number */
 
 
+  if (*buffer >= bufend)
+    return (0);
+
   valend = *buffer + length;
   oidptr = oid;
   oidend = oid + oidsize - 1;
@@ -1349,9 +1358,12 @@ asn1_get_packed(
   int  value;                          /* Value */
 
 
+  if (*buffer >= bufend)
+    return (0);
+
   value = 0;
 
-  while ((**buffer & 128) && *buffer < bufend)
+  while (*buffer < bufend && (**buffer & 128))
   {
     value = (value << 7) | (**buffer & 127);
     (*buffer) ++;
@@ -1379,6 +1391,9 @@ asn1_get_string(
     char          *string,             /* I  - String buffer */
     size_t        strsize)             /* I  - String buffer size */
 {
+  if (*buffer >= bufend)
+    return (NULL);
+
   if (length > (unsigned)(bufend - *buffer))
     length = (unsigned)(bufend - *buffer);
 
@@ -1421,6 +1436,9 @@ asn1_get_type(unsigned char **buffer,     /* IO - Pointer in buffer */
   int  type;                           /* Type */
 
 
+  if (*buffer >= bufend)
+    return (0);
+
   type = **buffer;
   (*buffer) ++;