From: Volker Lendecke <vl@samba.org>
Date: Mon, 26 Mar 2018 10:02:01 +0000 (+0200)
Subject: ndr_string: Do overflow checks in ndr_push/pull_charset
X-Git-Tag: talloc-2.1.13~124
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=1cd0fe90cf642de4ab4d03819f87a13c20bd2805;p=thirdparty%2Fsamba.git

ndr_string: Do overflow checks in ndr_push/pull_charset

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Wed Mar 28 16:08:16 CEST 2018 on sn-devel-144
---

diff --git a/librpc/ndr/ndr_string.c b/librpc/ndr/ndr_string.c
index 42ba3cfccc1..cc3508616bb 100644
--- a/librpc/ndr/ndr_string.c
+++ b/librpc/ndr/ndr_string.c
@@ -588,6 +588,9 @@ _PUBLIC_ enum ndr_err_code ndr_pull_charset(struct ndr_pull *ndr, int ndr_flags,
 		chset = CH_UTF16BE;
 	}
 
+	if ((byte_mul != 0) && (length > UINT32_MAX/byte_mul)) {
+		return ndr_pull_error(ndr, NDR_ERR_BUFSIZE, "length overflow");
+	}
 	NDR_PULL_NEED_BYTES(ndr, length*byte_mul);
 
 	if (!convert_string_talloc(ndr->current_mem_ctx, chset, CH_UNIX,
@@ -642,6 +645,9 @@ _PUBLIC_ enum ndr_err_code ndr_push_charset(struct ndr_push *ndr, int ndr_flags,
 		chset = CH_UTF16BE;
 	}
 
+	if ((byte_mul != 0) && (length > SIZE_MAX/byte_mul)) {
+		return ndr_push_error(ndr, NDR_ERR_LENGTH, "length overflow");
+	}
 	required = byte_mul * length;
 	
 	NDR_PUSH_NEED_BYTES(ndr, required);