summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJeremy Allison <jra@samba.org>2007-07-02 20:51:09 +0000
committerGerald (Jerry) Carter <jerry@samba.org>2007-10-10 12:23:45 -0500
commit56f6f58df2bae009e10352a0435ba4d70c5cacb7 (patch)
tree38a0bc92954a8e8314221c3829b991f49ad7e26a
parent7d6b8ff5b73c89dbd08339a8f8e22dec804a0fe1 (diff)
downloadsamba-56f6f58df2bae009e10352a0435ba4d70c5cacb7.tar.gz
samba-56f6f58df2bae009e10352a0435ba4d70c5cacb7.tar.bz2
samba-56f6f58df2bae009e10352a0435ba4d70c5cacb7.zip
r23673: Check for integer wrap on incoming data.
Jeremy. (This used to be commit 77a46c7aee2ad4c402527cf78e5ae70a792d65d4)
-rw-r--r--source3/lib/util_reg_api.c6
1 files changed, 6 insertions, 0 deletions
diff --git a/source3/lib/util_reg_api.c b/source3/lib/util_reg_api.c
index 8668bd8817..a4fb0261e3 100644
--- a/source3/lib/util_reg_api.c
+++ b/source3/lib/util_reg_api.c
@@ -80,6 +80,12 @@ WERROR registry_pull_value(TALLOC_CTX *mem_ctx,
tmp[num_ucs2] = 0;
}
+ if (length + 2 < length) {
+ /* Integer wrap. */
+ err = WERR_INVALID_PARAM;
+ goto error;
+ }
+
value->v.sz.len = convert_string_talloc(
value, CH_UTF16LE, CH_UNIX, tmp, length+2,
&value->v.sz.str, False);