From: Alan T. DeKok <aland@freeradius.org>
Date: Mon, 5 Feb 2018 19:45:28 +0000 (-0500)
Subject: check lengths for these, too
X-Git-Tag: release_3_0_17~81
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=87f63306031cf2cde39e81ebfd73873b48aba04f;p=thirdparty%2Ffreeradius-server.git

check lengths for these, too
---

diff --git a/src/lib/value.c b/src/lib/value.c
index 0a66bb075f2..dabccaf884b 100644
--- a/src/lib/value.c
+++ b/src/lib/value.c
@@ -980,6 +980,8 @@ static int value_data_hton(value_data_t *dst, PW_TYPE dst_type, void const *src,
 	/* 8 byte integers */
 	switch (dst_type) {
 	case PW_TYPE_INTEGER64:
+		if (src_len < sizeof(dst->integer64)) return -1;
+
 		dst->integer64 = htonll(*(uint64_t const *)src);
 		break;
 
@@ -987,11 +989,15 @@ static int value_data_hton(value_data_t *dst, PW_TYPE dst_type, void const *src,
 	case PW_TYPE_INTEGER:
 	case PW_TYPE_DATE:
 	case PW_TYPE_SIGNED:
+		if (src_len < sizeof(dst->integer)) return -1;
+
 		dst->integer = htonl(*(uint32_t const *)src);
 		break;
 
 	/* 2 byte integers */
 	case PW_TYPE_SHORT:
+		if (src_len < sizeof(dst->ushort)) return -1;
+
 		dst->ushort = htons(*(uint16_t const *)src);
 		break;