From: Alejandro Colomar <alx@kernel.org>
Date: Thu, 11 Jan 2024 11:15:11 +0000 (+0100)
Subject: lib/idmapping.c: get_map_ranges(): Move range check to a2ul() call
X-Git-Tag: 4.17.0-rc1~120
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=57aa813c733edec3ba458d8703b2d173f213757b;p=thirdparty%2Fshadow.git

lib/idmapping.c: get_map_ranges(): Move range check to a2ul() call

Link: <https://github.com/shadow-maint/shadow/commit/ff2baed5dbf81e8967b805889f565fedb48600df#r136635300>
Cc: Serge Hallyn <serge@hallyn.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
---

diff --git a/lib/idmapping.c b/lib/idmapping.c
index a4a4b6811..da3ceefbc 100644
--- a/lib/idmapping.c
+++ b/lib/idmapping.c
@@ -68,7 +68,10 @@ struct map_range *get_map_ranges(int ranges, int argc, char **argv)
 			free(mappings);
 			return NULL;
 		}
-		if (a2ul(&m->count, argv[argidx + 2], NULL, 0, 0, UINT_MAX) == -1) {
+		if (a2ul(&m->count, argv[argidx + 2], NULL, 0, 0,
+		         MIN(UINT_MAX - m->lower, UINT_MAX - m->upper))
+		    == -1)
+		{
 			if (errno == ERANGE) {
 				fprintf(log_get_logfd(), _( "%s: subuid overflow detected.\n"), log_get_progname());
 				exit(EXIT_FAILURE);
@@ -80,10 +83,6 @@ struct map_range *get_map_ranges(int ranges, int argc, char **argv)
 			fprintf(log_get_logfd(), _( "%s: subuid overflow detected.\n"), log_get_progname());
 			exit(EXIT_FAILURE);
 		}
-		if (m->lower + m->count > UINT_MAX || m->upper + m->count > UINT_MAX) {
-			fprintf(log_get_logfd(), _( "%s: subuid overflow detected.\n"), log_get_progname());
-			exit(EXIT_FAILURE);
-		}
 		if (m->lower + m->count < m->lower || m->upper + m->count < m->upper) {
 			/* this one really shouldn't be possible given previous checks */
 			fprintf(log_get_logfd(), _( "%s: subuid overflow detected.\n"), log_get_progname());