Fix possible buffer overrun for some large name_len values.

Fixes bug 12568.

diff --git a/xattrs.c b/xattrs.c
index 75b1c206f277dda3d8d832cf226f35286a738d9a..68305d7559b34f5cc2f196b74429b82fa6ff49dd 100644 (file)
--- a/xattrs.c
+++ b/xattrs.c
@@ -817,7 +817,7 @@ void receive_xattr(int f, struct file_struct *file)
                size_t dget_len = datum_len > MAX_FULL_DATUM ? 1 + MAX_DIGEST_LEN : datum_len;
                size_t extra_len = MIGHT_NEED_RPRE ? RPRE_LEN : 0;
                if ((dget_len + extra_len < dget_len)
-                || (dget_len + extra_len + name_len < dget_len))
+                || (dget_len + extra_len + name_len < dget_len + extra_len))
                        overflow_exit("receive_xattr");
                ptr = new_array(char, dget_len + extra_len + name_len);
                if (!ptr)