summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJeremy Allison <jra@samba.org>2004-02-11 23:25:51 +0000
committerJeremy Allison <jra@samba.org>2004-02-11 23:25:51 +0000
commit9860bfe384dcdc578fb793bbc0736e51131fe9a2 (patch)
tree2e86d0f497e289c4c02b05758749250c038a8975
parente7a09dd6375cf4d81a4ef79b8551009c2cf3244c (diff)
downloadsamba-9860bfe384dcdc578fb793bbc0736e51131fe9a2.tar.gz
samba-9860bfe384dcdc578fb793bbc0736e51131fe9a2.tar.bz2
samba-9860bfe384dcdc578fb793bbc0736e51131fe9a2.zip
More paranoia checks.
Jeremy. (This used to be commit adf8ee3df75b8336d14ad093ad2ebc3a480d0017)
-rw-r--r--source3/libsmb/asn1.c5
1 files changed, 5 insertions, 0 deletions
diff --git a/source3/libsmb/asn1.c b/source3/libsmb/asn1.c
index 17170b015f..ecc5e3dee6 100644
--- a/source3/libsmb/asn1.c
+++ b/source3/libsmb/asn1.c
@@ -219,6 +219,11 @@ BOOL asn1_load(ASN1_DATA *data, DATA_BLOB blob)
/* read from a ASN1 buffer, advancing the buffer pointer */
BOOL asn1_read(ASN1_DATA *data, void *p, int len)
{
+ if (len < 0 || data->ofs + len < data->ofs || data->ofs + len < len) {
+ data->has_error = True;
+ return False;
+ }
+
if (data->ofs + len > data->length) {
data->has_error = True;
return False;