From: Ulrich Drepper <drepper@redhat.com>
Date: Fri, 2 Aug 2002 01:35:39 +0000 (+0000)
Subject: (xdr_array): Check for overflow on multiplication.
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=5e555ecb75b29bfcc7d1cfc934983b0169bc0d78;p=thirdparty%2Fglibc.git

(xdr_array): Check for overflow on multiplication.
---

diff --git a/sunrpc/xdr_array.c b/sunrpc/xdr_array.c
index 2dbf8c1e8c9..da5ba9cde8c 100644
--- a/sunrpc/xdr_array.c
+++ b/sunrpc/xdr_array.c
@@ -45,6 +45,7 @@ static char sccsid[] = "@(#)xdr_array.c 1.10 87/08/11 Copyr 1984 Sun Micro";
 #include <rpc/types.h>
 #include <rpc/xdr.h>
 #include <libintl.h>
+#include <limits.h>
 
 #ifdef USE_IN_LIBIO
 # include <wchar.h>
@@ -81,7 +82,11 @@ xdr_array (xdrs, addrp, sizep, maxsize, elsize, elproc)
       return FALSE;
     }
   c = *sizep;
-  if ((c > maxsize) && (xdrs->x_op != XDR_FREE))
+  /*
+   * XXX: Let the overflow possibly happen with XDR_FREE because mem_free()
+   * doesn't actually use its second argument anyway.
+   */
+  if ((c > maxsize || c > UINT_MAX / elsize) && (xdrs->x_op != XDR_FREE))
     {
       return FALSE;
     }