The wrapping of pointer arithmetic is undefined behaviour. Clang from version 20
onwards will treat an overflow check of the following form:
ptr + offset < ptr
as always evaluating to false
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16092
Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
#include "../librpc/gen_ndr/svcctl.h"
#include "clirap2.h"
#include "../libcli/smb/smbXcli_base.h"
+#include "lib/util/overflow.h"
#define WORDSIZE 2
#define DWORDSIZE 4
off &= 0x0000FFFF; /* mask the obsolete segment number from the offset */
off -= c;
}
- if (r+off > endp || r+off < r) {
+ if (offset_outside_range(r, endp, off)) {
src="";
len=1;
} else {