From: Arran Cudbard-Bell <a.cudbardb@freeradius.org>
Date: Sun, 15 Sep 2019 19:13:16 +0000 (-0500)
Subject: CID #1453692 - Check stack overrun *AFTER* incrementing ctx->stack_depth
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=b523919ecb79bf5d371bd558283d0063e7a9ce5f;p=thirdparty%2Ffreeradius-server.git

CID #1453692 - Check stack overrun *AFTER* incrementing ctx->stack_depth
---

diff --git a/src/lib/util/dict_tokenize.c b/src/lib/util/dict_tokenize.c
index be2306a26f7..7e2fb319370 100644
--- a/src/lib/util/dict_tokenize.c
+++ b/src/lib/util/dict_tokenize.c
@@ -423,12 +423,13 @@ static int dict_process_flag_field(dict_tokenize_ctx_t *ctx, char *name, fr_type
 
 static int dict_ctx_push(dict_tokenize_ctx_t *ctx, fr_dict_attr_t const *da)
 {
+	ctx->stack_depth++;
+
 	if (ctx->stack_depth >= MAX_STACK) {
 		fr_strerror_printf_push("Attribute definitions are nested too deep.");
 		return -1;
 	}
 
-	ctx->stack_depth++;
 	memset(&ctx->stack[ctx->stack_depth], 0, sizeof(ctx->stack[ctx->stack_depth]));
 
 	ctx->stack[ctx->stack_depth].dict = ctx->stack[ctx->stack_depth - 1].dict;