Commit c4e4b684 authored by Lev Walkin's avatar Lev Walkin

length value limit

parent 27d7049f
......@@ -51,6 +51,19 @@ ber_fetch_length(int _is_constructed, void *bufptr, size_t size,
}
if(oct == 0) {
/*
* Here length may be very close or equal to 2G.
* However, the arithmetics used in other decoders
* often add some (small) quantities to the length,
* to check the resulting value against some limits.
* This may result in integer wrap-around.
*/
if((len + 1024) < 0) {
/* Too large length value */
return -1;
}
*len_r = len;
return skipped;
}
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment