From: Arran Cudbard-Bell <a.cudbardb@freeradius.org>
Date: Thu, 28 Jan 2021 15:00:00 +0000 (+0000)
Subject: Don't allow the length argument of fr_dbuff_advance to be a signed integer
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=10fb277a35dfab6daf2f8d0342194a6f31e2ae48;p=thirdparty%2Ffreeradius-server.git

Don't allow the length argument of fr_dbuff_advance to be a signed integer
---

diff --git a/src/lib/util/dbuff.c b/src/lib/util/dbuff.c
index cf32e154ab..6af875b048 100644
--- a/src/lib/util/dbuff.c
+++ b/src/lib/util/dbuff.c
@@ -50,7 +50,7 @@ size_t _fr_dbuff_move_##_in_type##_to_##_out_type(fr_##_out_type##_t *out, fr_##
 		if (to_copy == 0) break; \
 		to_copy = _fr_dbuff_safecpy(fr_dbuff_current(out), fr_dbuff_end(out), \
 					    fr_dbuff_current(in), fr_dbuff_current(in) + to_copy); \
-		fr_dbuff_advance(out, fr_dbuff_advance(in, to_copy)); \
+		fr_dbuff_advance(out, (size_t)fr_dbuff_advance(in, to_copy)); \
 		remaining -= to_copy; \
 	} \
 	return len - remaining; \
diff --git a/src/lib/util/dbuff.h b/src/lib/util/dbuff.h
index 10f202057d..1aa5d2ddb0 100644
--- a/src/lib/util/dbuff.h
+++ b/src/lib/util/dbuff.h
@@ -926,12 +926,25 @@ _fr_dbuff_set(\
  *
  * @param[in] _dbuff_or_marker	to advance.
  * @param[in] _len		How much to advance dbuff by.
+ *				Must be a positive integer.
  * @return
  *	- 0	not advanced.
  *	- >0	the number of bytes the dbuff or marker was advanced by.
  *	- <0	the number of bytes required to complete the advancement
  */
-#define fr_dbuff_advance(_dbuff_or_marker, _len)  fr_dbuff_set(_dbuff_or_marker, (fr_dbuff_current(_dbuff_or_marker) + (_len)))
+#define fr_dbuff_advance(_dbuff_or_marker, _len)  \
+	fr_dbuff_set(_dbuff_or_marker, \
+		     (fr_dbuff_current(_dbuff_or_marker) + \
+		     (_Generic((_len), \
+		        uint8_t	: (size_t)(_len), \
+			uint16_t : (size_t)(_len), \
+			uint32_t : (size_t)(_len), \
+			uint64_t : (size_t)(_len), \
+			int : (size_t)(_len), \
+			long : (size_t)(_len), \
+			long long : (size_t)(_len), \
+			size_t : (_len) \
+		     ))))
 
 /** Advance the 'current' position in dbuff or marker by _len bytes returning if _len is out of range
  *
diff --git a/src/lib/util/dns.c b/src/lib/util/dns.c
index eb89182243..4d5f150299 100644
--- a/src/lib/util/dns.c
+++ b/src/lib/util/dns.c
@@ -503,7 +503,7 @@ ssize_t fr_dns_label_from_value_box_dbuff(fr_dbuff_t *dbuff, bool compression, f
 
 	if (slen == 0) return -need;
 
-	fr_dbuff_advance(dbuff, slen);
+	fr_dbuff_advance(dbuff, (size_t)slen);
 	return slen;
 }