[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: security-related gcc bug



Howard Chu writes:
> 	char buf[MYSIZE];
> 	ber_len_t len;		/* length of current buffer content */
> 	struct berval *in;	/* passed in, to be moved into buf */
>
> You just test:
> 	if ( in->bv_len > MYSIZE || in->bv_len + len > MYSIZE )
> 		return FAIL;

Except that in->bv_len + len can wrap around:-) In this case, use
if ( in->bv_len > MYSIZE - len ) since len will be <= MYSIZE.

-- 
Hallvard