From 224379ba70a6939bd6a92012f023caeb7e43d6b7 Mon Sep 17 00:00:00 2001
From: Stefan Metzmacher <metze@samba.org>
Date: Thu, 15 Mar 2012 17:03:05 +0100
Subject: pidl/NDR/Parser: also do range checks on the array size

metze

Autobuild-User: Karolin Seeger <kseeger@samba.org>
Autobuild-Date: Tue Apr 10 18:21:59 CEST 2012 on sn-devel-104
---
 pidl/lib/Parse/Pidl/Samba4/NDR/Parser.pm | 25 ++++++++++++++++++++-----
 1 file changed, 20 insertions(+), 5 deletions(-)

(limited to 'pidl')

diff --git a/pidl/lib/Parse/Pidl/Samba4/NDR/Parser.pm b/pidl/lib/Parse/Pidl/Samba4/NDR/Parser.pm
index 541e52926d..8eb935bf22 100644
--- a/pidl/lib/Parse/Pidl/Samba4/NDR/Parser.pm
+++ b/pidl/lib/Parse/Pidl/Samba4/NDR/Parser.pm
@@ -341,6 +341,20 @@ sub ParseArrayPullGetSize($$$$$$)
 	$self->pidl("size_$e->{NAME}_$l->{LEVEL_INDEX} = $size;");
 	my $array_size = "size_$e->{NAME}_$l->{LEVEL_INDEX}";
 
+	if (my $range = has_property($e, "range")) {
+		my ($low, $high) = split(/,/, $range, 2);
+		if ($low < 0) {
+			warning(0, "$low is invalid for the range of an array size");
+		}
+		if ($low == 0) {
+			$self->pidl("if ($array_size > $high) {");
+		} else {
+			$self->pidl("if ($array_size < $low || $array_size > $high) {");
+		}
+		$self->pidl("\treturn ndr_pull_error($ndr, NDR_ERR_RANGE, \"value out of range\");");
+		$self->pidl("}");
+	}
+
 	return $array_size;
 }
 
@@ -354,13 +368,14 @@ sub ParseArrayPullGetLength($$$$$$;$)
 		$array_size = $self->ParseArrayPullGetSize($e, $l, $ndr, $var_name, $env);
 	}
 
-	my $array_length = $array_size;
-	if ($l->{IS_VARYING}) {
-		my $length = "ndr_get_array_length($ndr, " . get_pointer_to($var_name) .")";
-		$self->pidl("length_$e->{NAME}_$l->{LEVEL_INDEX} = $length;");
-		$array_length = "length_$e->{NAME}_$l->{LEVEL_INDEX}";
+	if (not $l->{IS_VARYING}) {
+		return $array_size;
 	}
 
+	my $length = "ndr_get_array_length($ndr, " . get_pointer_to($var_name) .")";
+	$self->pidl("length_$e->{NAME}_$l->{LEVEL_INDEX} = $length;");
+	my $array_length = "length_$e->{NAME}_$l->{LEVEL_INDEX}";
+
 	if (my $range = has_property($e, "range")) {
 		my ($low, $high) = split(/,/, $range, 2);
 		if ($low < 0) {
-- 
cgit