check for uint32 overflow. CID #1419874

diff --git a/src/modules/rlm_sql/drivers/rlm_sql_sqlite/rlm_sql_sqlite.c b/src/modules/rlm_sql/drivers/rlm_sql_sqlite/rlm_sql_sqlite.c
index 058547fd62016ab483097fb737c84ddf8d6f427d..e488f46da4ff25a5e5632213c10cb7bcfea499d0 100644 (file)
--- a/src/modules/rlm_sql/drivers/rlm_sql_sqlite/rlm_sql_sqlite.c
+++ b/src/modules/rlm_sql/drivers/rlm_sql_sqlite/rlm_sql_sqlite.c
@@ -324,16 +324,28 @@ static int sql_loadfile(TALLOC_CTX *ctx, sqlite3 *db, char const *filename)
         */
        p = buffer;
        while ((q = strchr(p, ';'))) {
+               uint32_t statement_len;
+
                if ((q[1] != '\n') && (q[1] != '\0')) {
                        p = q + 1;
                        statement_cnt++;
                        continue;
                }
 
+#ifndef NDEBUG
+               if ((q - p) > (1 << 20)) {
+                       sql_print_error(db, status, "Failed preparing statement %i: too long!", statement_cnt);
+                       talloc_free(buffer);
+                       return -1;
+               }
+#endif
+
+               statement_len = q - p;
+
 #ifdef HAVE_SQLITE3_PREPARE_V2
-               status = sqlite3_prepare_v2(db, p, q - p, &statement, &z_tail);
+               status = sqlite3_prepare_v2(db, p, statement_len, &statement, &z_tail);
 #else
-               status = sqlite3_prepare(db, p, q - p, &statement, &z_tail);
+               status = sqlite3_prepare(db, p, statement_len, &statement, &z_tail);
 #endif
 
                if (sql_check_error(db, status) != RLM_SQL_OK) {