privsep: limit psr_datalen to SSIZE_MAX

diff --git a/src/privsep-root.c b/src/privsep-root.c
index 8ff3230375085ef095bbaee17912eaeec6da52de..f3fc523c2c153060211cac7d10ea105f3285a571 100644 (file)
--- a/src/privsep-root.c
+++ b/src/privsep-root.c
@@ -151,6 +151,8 @@ ps_root_mreaderrorcb(void *arg)
                PSR_ERROR(errno);
        else if ((size_t)len < sizeof(*psr_error))
                PSR_ERROR(EINVAL);
+       else if (psr_error->psr_datalen > SSIZE_MAX)
+               PSR_ERROR(ENOBUFS);
 
        if (psr_error->psr_datalen != 0) {
                psr_ctx->psr_data = malloc(psr_error->psr_datalen);