lib: Add some overflow protection to message_push_blob()

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

diff --git a/source3/lib/util.c b/source3/lib/util.c
index 531af25dc27356e2613471c92a227e95552efae2..20e72c3ad8b513b0bacc643233921e8ca81f8de7 100644 (file)
--- a/source3/lib/util.c
+++ b/source3/lib/util.c
@@ -210,9 +210,19 @@ int set_message_bcc(char *buf,int num_bytes)
 
 ssize_t message_push_blob(uint8_t **outbuf, DATA_BLOB blob)
 {
-       size_t newlen = smb_len(*outbuf) + 4 + blob.length;
+       size_t newlen;
        uint8_t *tmp;
 
+       newlen = smb_len(*outbuf) + 4;
+       if (newlen < 4) {
+               return -1;
+       }
+
+       newlen += blob.length;
+       if (newlen < blob.length) {
+               return -1;
+       }
+
        if (!(tmp = talloc_realloc(NULL, *outbuf, uint8_t, newlen))) {
                DEBUG(0, ("talloc failed\n"));
                return -1;