From: Volker Lendecke <vl@samba.org>
Date: Thu, 4 Oct 2018 09:07:21 +0000 (+0200)
Subject: tdb_unpack: Protect against overflow
X-Git-Tag: tdb-1.3.17~1397
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ba787dc4ad3fd7195aee56567be9317358197bab;p=thirdparty%2Fsamba.git

tdb_unpack: Protect against overflow

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
---

diff --git a/source3/lib/util_tdb.c b/source3/lib/util_tdb.c
index 035daf8b7b7..9730a030c10 100644
--- a/source3/lib/util_tdb.c
+++ b/source3/lib/util_tdb.c
@@ -227,6 +227,9 @@ int tdb_unpack(const uint8_t *buf, int in_bufsize, const char *fmt, ...)
 				break;
 			}
 			len += *i;
+			if (len < *i) {
+				goto no_space;
+			}
 			if (bufsize < len)
 				goto no_space;
 			*b = (char *)SMB_MALLOC(*i);