diff options
| -rw-r--r-- | source4/libcli/raw/raweas.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/source4/libcli/raw/raweas.c b/source4/libcli/raw/raweas.c index 5f06e7001d..b626b316d2 100644 --- a/source4/libcli/raw/raweas.c +++ b/source4/libcli/raw/raweas.c @@ -243,9 +243,12 @@ NTSTATUS ea_pull_list_chained(const DATA_BLOB *blob, return NT_STATUS_INVALID_PARAMETER; } - ofs += next_ofs; + if (ofs + next_ofs < ofs) { + return NT_STATUS_INVALID_PARAMETER; + } - if (ofs+4 > blob->length) { + ofs += next_ofs; + if (ofs+4 > blob->length || ofs+4 < ofs) { return NT_STATUS_INVALID_PARAMETER; } n++; |