From: Alan T. DeKok <aland@freeradius.org>
Date: Fri, 20 Oct 2017 18:07:55 +0000 (-0400)
Subject: check for uint32 overflow.  CID #1419874
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=cebfa739a2207a00a0867c3e22121f23b6510893;p=thirdparty%2Ffreeradius-server.git

check for uint32 overflow.  CID #1419874
---

diff --git a/src/modules/rlm_sql/drivers/rlm_sql_sqlite/rlm_sql_sqlite.c b/src/modules/rlm_sql/drivers/rlm_sql_sqlite/rlm_sql_sqlite.c
index 058547fd620..e488f46da4f 100644
--- a/src/modules/rlm_sql/drivers/rlm_sql_sqlite/rlm_sql_sqlite.c
+++ b/src/modules/rlm_sql/drivers/rlm_sql_sqlite/rlm_sql_sqlite.c
@@ -324,16 +324,28 @@ static int sql_loadfile(TALLOC_CTX *ctx, sqlite3 *db, char const *filename)
 	 */
 	p = buffer;
 	while ((q = strchr(p, ';'))) {
+		uint32_t statement_len;
+
 		if ((q[1] != '\n') && (q[1] != '\0')) {
 			p = q + 1;
 			statement_cnt++;
 			continue;
 		}
 
+#ifndef NDEBUG
+		if ((q - p) > (1 << 20)) {
+			sql_print_error(db, status, "Failed preparing statement %i: too long!", statement_cnt);
+			talloc_free(buffer);
+			return -1;
+		}
+#endif
+
+		statement_len = q - p;
+
 #ifdef HAVE_SQLITE3_PREPARE_V2
-		status = sqlite3_prepare_v2(db, p, q - p, &statement, &z_tail);
+		status = sqlite3_prepare_v2(db, p, statement_len, &statement, &z_tail);
 #else
-		status = sqlite3_prepare(db, p, q - p, &statement, &z_tail);
+		status = sqlite3_prepare(db, p, statement_len, &statement, &z_tail);
 #endif
 
 		if (sql_check_error(db, status) != RLM_SQL_OK) {