From: Gary Lockyer <gary@catalyst.net.nz>
Date: Wed, 15 Apr 2026 01:32:11 +0000 (+1200)
Subject: s3:libsmb:cliquota fix tautological-compare
X-Git-Tag: talloc-2.5.0~495
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=b58d7045d5444d70db58d07d7746006ea1b9ecfb;p=thirdparty%2Fsamba.git

s3:libsmb:cliquota fix tautological-compare

The wrapping of pointer arithmetic is undefined behaviour. Clang from version 20
onwards will treat an overflow check of the following form:
   ptr + offset < ptr
as always evaluating to false

BUG: https://bugzilla.samba.org/show_bug.cgi?id=16092

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
---

diff --git a/source3/libsmb/cliquota.c b/source3/libsmb/cliquota.c
index 0f38c275792..5a2a1b4028c 100644
--- a/source3/libsmb/cliquota.c
+++ b/source3/libsmb/cliquota.c
@@ -27,6 +27,7 @@
 #include "trans2.h"
 #include "../libcli/smb/smbXcli_base.h"
 #include "librpc/gen_ndr/ndr_quota.h"
+#include "lib/util/overflow.h"
 
 NTSTATUS cli_get_quota_handle(struct cli_state *cli, uint16_t *quota_fnum)
 {
@@ -136,7 +137,7 @@ NTSTATUS parse_user_quota_list(const uint8_t *curdata,
 			break;
 		}
 
-		if (curdata + offset < curdata) {
+		if (ptr_overflow(curdata, offset, uint8_t)) {
 			DEBUG(1, ("Pointer overflow in quota record\n"));
 			status = NT_STATUS_INVALID_NETWORK_RESPONSE;
 			break;