summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorVolker Lendecke <vl@samba.org>2013-05-30 16:23:17 +0200
committerVolker Lendecke <vl@samba.org>2013-06-03 14:08:53 +0200
commit1f269fcc6e2bb46b765d547eb1add2bc52272c47 (patch)
treeee238c7b6301125ad21efa4072dea76bce230688
parentd9b4f19e73f241a1ccf64f04c3cc28d481550bb7 (diff)
downloadsamba-1f269fcc6e2bb46b765d547eb1add2bc52272c47.tar.gz
samba-1f269fcc6e2bb46b765d547eb1add2bc52272c47.tar.bz2
samba-1f269fcc6e2bb46b765d547eb1add2bc52272c47.zip
tdb: Add another overflow check to tdb_expand_adjust
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Rusty Russell <rusty@rustcorp.com.au> Autobuild-User(master): Volker Lendecke <vl@samba.org> Autobuild-Date(master): Mon Jun 3 14:08:54 CEST 2013 on sn-devel-104
-rw-r--r--lib/tdb/common/io.c6
1 files changed, 6 insertions, 0 deletions
diff --git a/lib/tdb/common/io.c b/lib/tdb/common/io.c
index 87d47b970b..11dfefd102 100644
--- a/lib/tdb/common/io.c
+++ b/lib/tdb/common/io.c
@@ -405,6 +405,12 @@ tdb_off_t tdb_expand_adjust(tdb_off_t map_size, tdb_off_t size, int page_size)
/* Round the database up to a multiple of the page size */
new_size = MAX(top_size, new_size);
+
+ if (new_size + page_size < new_size) {
+ /* There's a "+" in TDB_ALIGN that might overflow... */
+ goto overflow;
+ }
+
return TDB_ALIGN(new_size, page_size) - map_size;
overflow: