nspawn-oci: update overflow check

Fixes CID#1548072.

diff --git a/src/nspawn/nspawn-oci.c b/src/nspawn/nspawn-oci.c
index ecbcaefcbb1c4071b9a0c9f7140aec6eeb078d5f..923e20b5c037bd165bdff38247bd6331f2d16ac3 100644 (file)
--- a/src/nspawn/nspawn-oci.c
+++ b/src/nspawn/nspawn-oci.c
@@ -700,8 +700,8 @@ static int oci_uid_gid_mappings(const char *name, sd_json_variant *v, sd_json_di
         if (r < 0)
                 return r;
 
-        if (data.host_id + data.range < data.host_id ||
-            data.container_id + data.range < data.container_id)
+        if (data.range > UINT32_MAX - data.host_id ||
+            data.range > UINT32_MAX - data.container_id)
                 return json_log(v, flags, SYNTHETIC_ERRNO(EINVAL),
                                 "UID/GID range goes beyond UID/GID validity range, refusing.");