From: Volker Lendecke <vl@samba.org>
Date: Wed, 1 Jul 2026 15:34:54 +0000 (+0200)
Subject: lib: Add some overflow protection to message_push_blob()
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=af98d54a299799bfb9cd8472e7f18d44bce496c1;p=thirdparty%2Fsamba.git

lib: Add some overflow protection to message_push_blob()

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>
---

diff --git a/source3/lib/util.c b/source3/lib/util.c
index 531af25dc27..20e72c3ad8b 100644
--- a/source3/lib/util.c
+++ b/source3/lib/util.c
@@ -210,9 +210,19 @@ int set_message_bcc(char *buf,int num_bytes)
 
 ssize_t message_push_blob(uint8_t **outbuf, DATA_BLOB blob)
 {
-	size_t newlen = smb_len(*outbuf) + 4 + blob.length;
+	size_t newlen;
 	uint8_t *tmp;
 
+	newlen = smb_len(*outbuf) + 4;
+	if (newlen < 4) {
+		return -1;
+	}
+
+	newlen += blob.length;
+	if (newlen < blob.length) {
+		return -1;
+	}
+
 	if (!(tmp = talloc_realloc(NULL, *outbuf, uint8_t, newlen))) {
 		DEBUG(0, ("talloc failed\n"));
 		return -1;