tdb_unpack: Protect against overflow

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

diff --git a/source3/lib/util_tdb.c b/source3/lib/util_tdb.c
index 035daf8b7b77064a52951a94c2c3b0fcfe61b651..9730a030c10c6df71c33cdf5841eeff1bc3116f1 100644 (file)
--- a/source3/lib/util_tdb.c
+++ b/source3/lib/util_tdb.c
@@ -227,6 +227,9 @@ int tdb_unpack(const uint8_t *buf, int in_bufsize, const char *fmt, ...)
                                break;
                        }
                        len += *i;
+                       if (len < *i) {
+                               goto no_space;
+                       }
                        if (bufsize < len)
                                goto no_space;
                        *b = (char *)SMB_MALLOC(*i);