libndr: Add overflow check to ndr_push_subcontext_end()

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Mon Nov 25 15:36:07 UTC 2024 on atb-devel-224

diff --git a/librpc/ndr/ndr.c b/librpc/ndr/ndr.c
index 24db73d50010a5f33c9fac6da9b93773fa2cec62..b48c798cd7524f7ecdc3b50d9702f9e0778fd488 100644 (file)
--- a/librpc/ndr/ndr.c
+++ b/librpc/ndr/ndr.c
@@ -936,6 +936,14 @@ _PUBLIC_ enum ndr_err_code ndr_push_subcontext_end(struct ndr_push *ndr,
                break;
 
        case 2:
+               if (subndr->offset > UINT16_MAX) {
+                       return ndr_push_error(
+                               ndr,
+                               NDR_ERR_BUFSIZE,
+                               "Subcontext (PUSH) too large: %" PRIu32
+                               " does not fit into 16 bits",
+                               subndr->offset);
+               }
                NDR_CHECK(ndr_push_uint16(ndr, NDR_SCALARS, subndr->offset));
                break;