From: Alan T. DeKok <aland@freeradius.org>
Date: Wed, 30 Oct 2019 21:18:06 +0000 (-0400)
Subject: check input length against minimum size
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7306b2fb73f2dfb4ba0979d7c0f12ffebb8cb446;p=thirdparty%2Ffreeradius-server.git

check input length against minimum size
---

diff --git a/src/lib/util/value.c b/src/lib/util/value.c
index 3762d4c4ac3..60dbe03946a 100644
--- a/src/lib/util/value.c
+++ b/src/lib/util/value.c
@@ -1429,7 +1429,7 @@ ssize_t fr_value_box_from_network(TALLOC_CTX *ctx,
 		 */
 	case FR_TYPE_DATE:
 	{
-		int i, length = 4;
+		size_t i, length = 4;
 		int precision = FR_TIME_RES_SEC;
 		uint64_t date;
 		struct timespec ts;
@@ -1439,6 +1439,12 @@ ssize_t fr_value_box_from_network(TALLOC_CTX *ctx,
 			precision = enumv->flags.type_size;
 		}
 
+		/*
+		 *	Input data doesn't match what we were told we
+		 *	need.
+		 */
+		if (len != length) return -1;
+
 		/*
 		 *	Just loop over the input data until we reach
 		 *	the end.  Shifting it every time.
@@ -1483,7 +1489,7 @@ ssize_t fr_value_box_from_network(TALLOC_CTX *ctx,
 
 	case FR_TYPE_TIME_DELTA:
 	{
-		int i, length = 4;
+		size_t i, length = 4;
 		int precision = FR_TIME_RES_SEC;
 		uint64_t date;
 
@@ -1492,6 +1498,12 @@ ssize_t fr_value_box_from_network(TALLOC_CTX *ctx,
 			precision = enumv->flags.type_size;
 		}
 
+		/*
+		 *	Input data doesn't match what we were told we
+		 *	need.
+		 */
+		if (len != length) return -1;
+
 		/*
 		 *	Just loop over the input data until we reach
 		 *	the end.  Shifting it every time.