From: Volker Lendecke <vl@samba.org>
Date: Tue, 8 May 2018 06:41:04 +0000 (+0200)
Subject: printing: Fix CID 1435452 (TAINTED_SCALAR)
X-Git-Tag: ldb-1.4.0~343
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e8a04f72a5a123d8837a945b464d2081238c8473;p=thirdparty%2Fsamba.git

printing: Fix CID 1435452 (TAINTED_SCALAR)

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ira Cooper <ira@samba.org>
---

diff --git a/source3/printing/nt_printing.c b/source3/printing/nt_printing.c
index 395f7b87da6..1639bfd4406 100644
--- a/source3/printing/nt_printing.c
+++ b/source3/printing/nt_printing.c
@@ -390,6 +390,12 @@ static int handle_pe_file(files_struct *fsp,
 
 	/* get the section table */
 	num_sections        = SVAL(buf,PE_HEADER_NUMBER_OF_SECTIONS);
+
+	if (num_sections >= (UINT_MAX / PE_HEADER_SECT_HEADER_SIZE)) {
+		/* Integer wrap. */
+		goto out;
+	}
+
 	section_table_bytes = num_sections * PE_HEADER_SECT_HEADER_SIZE;
 	if (section_table_bytes == 0) {
 		goto out;