From: Tim Wiederhake <twiederh@redhat.com>
Date: Thu, 22 Jul 2021 08:30:21 +0000 (+0200)
Subject: virFileReadLimFD: Cast maxlen to size_t before adding
X-Git-Tag: v7.6.0-rc1~122
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=2ed93ed979170c3310ace5cdf75a99873ba9d317;p=thirdparty%2Flibvirt.git

virFileReadLimFD: Cast maxlen to size_t before adding

If the function is called with maxlen equal to `INT_MAX`, adding
one will trigger a signed integer overflow.

Signed-off-by: Tim Wiederhake <twiederh@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
---

diff --git a/src/util/virfile.c b/src/util/virfile.c
index 723e1ca6e5..ad491251a2 100644
--- a/src/util/virfile.c
+++ b/src/util/virfile.c
@@ -1422,7 +1422,7 @@ virFileReadLimFD(int fd, int maxlen, char **buf)
         errno = EINVAL;
         return -1;
     }
-    s = saferead_lim(fd, maxlen+1, &len);
+    s = saferead_lim(fd, (size_t) maxlen + 1, &len);
     if (s == NULL)
         return -1;
     if (len > maxlen || (int)len != len) {