From: Volker Lendecke <vl@samba.org>
Date: Tue, 26 Feb 2019 10:06:29 +0000 (+0100)
Subject: libwbclient: Protect wbcCtxUnixIdsToSids against integer-wrap
X-Git-Tag: talloc-2.2.0~253
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d8a7caa5b03428dd9b0808135b34c21e217dbe2e;p=thirdparty%2Fsamba.git

libwbclient: Protect wbcCtxUnixIdsToSids against integer-wrap

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Christof Schmitt <cs@samba.org>
---

diff --git a/nsswitch/libwbclient/wbc_idmap.c b/nsswitch/libwbclient/wbc_idmap.c
index f61efb92b8d..6876a95316c 100644
--- a/nsswitch/libwbclient/wbc_idmap.c
+++ b/nsswitch/libwbclient/wbc_idmap.c
@@ -423,10 +423,20 @@ wbcErr wbcCtxUnixIdsToSids(struct wbcContext *ctx,
 	wbcErr wbc_status;
 	char *buf;
 	char *s;
+	const size_t sidlen = (1 /* U/G */ + 10 /* 2^32 */ + 1 /* \n */);
 	size_t ofs, buflen;
 	uint32_t i;
 
-	buflen = num_ids * (1 /* U/G */ + 10 /* 2^32 */ + 1 /* \n */) + 1;
+	if (num_ids > SIZE_MAX / sidlen) {
+		return WBC_ERR_NO_MEMORY; /* overflow */
+	}
+	buflen = num_ids * sidlen;
+
+	buflen += 1;		/* trailing \0 */
+	if (buflen < 1) {
+		return WBC_ERR_NO_MEMORY; /* overflow */
+	}
+
 	buf = malloc(buflen);
 	if (buf == NULL) {
 		return WBC_ERR_NO_MEMORY;