From: Wayne Davison <wayned@samba.org>
Date: Sun, 8 Oct 2017 00:54:03 +0000 (-0700)
Subject: Fix possible buffer overrun for some large name_len values.
X-Git-Tag: v3.1.3pre1~24
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=3fb1634f21fdad145eb30d9387e7f8d48f1f7692;p=thirdparty%2Frsync.git

Fix possible buffer overrun for some large name_len values.
Fixes bug 12568.
---

diff --git a/xattrs.c b/xattrs.c
index 75b1c206..68305d75 100644
--- a/xattrs.c
+++ b/xattrs.c
@@ -817,7 +817,7 @@ void receive_xattr(int f, struct file_struct *file)
 		size_t dget_len = datum_len > MAX_FULL_DATUM ? 1 + MAX_DIGEST_LEN : datum_len;
 		size_t extra_len = MIGHT_NEED_RPRE ? RPRE_LEN : 0;
 		if ((dget_len + extra_len < dget_len)
-		 || (dget_len + extra_len + name_len < dget_len))
+		 || (dget_len + extra_len + name_len < dget_len + extra_len))
 			overflow_exit("receive_xattr");
 		ptr = new_array(char, dget_len + extra_len + name_len);
 		if (!ptr)