Changeset b2e6406 in mod_gnutls

Timestamp:

Jun 10, 2016, 3:14:51 PM (5 years ago)

Author:

Thomas Klute <thomas2.klute@…>

Branches:

asyncio, debian/master, debian/stretch-backports, master, proxy-ticket, upstream

Children:

11e6205

Parents:

15b22cb

Message:

Safe integer type conversion in mgs_filter_input()

Read sizes should be too small for 32 or 64 bit integer length to
matter, but we have to make sure.

File:

• src/gnutls_io.c (modified) (1 diff)

src/gnutls_io.c

@@ -561 +561 @@
             return APR_ENOTIMPL;
         }
-        /* Err. This is bad. readbytes *can* be a 64bit int! len.. is NOT */
-        if ((apr_size_t) readbytes < len) {
-            len = (apr_size_t) readbytes;
+        /* 'readbytes' and 'len' are of different integer types, which
+         * might have different lengths. Read sizes should be too
+         * small for 32 or 64 bit to matter, but we have to make
+         * sure. */
+        if ((apr_size_t) readbytes < len
+            && __builtin_add_overflow(readbytes, 0, &len))
+        {
+            ap_log_cerror(APLOG_MARK, APLOG_CRIT, APR_EINVAL, ctxt->c,
+                          "%s: prevented buffer length overflow",
+                          __func__);
+            return APR_EINVAL;
         }
         status =