util/charset/convert: do not overflow dest len
authorDouglas Bagnall <douglas.bagnall@catalyst.net.nz>
Fri, 10 May 2019 05:07:43 +0000 (17:07 +1200)
committerAndrew Bartlett <abartlet@samba.org>
Wed, 15 May 2019 04:03:37 +0000 (04:03 +0000)
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
lib/util/charset/convert_string.c

index 4197065215492b76d62a250b28de879b2e17dd8c..afc8f5c4db2338ea86afebeb195416e9e2fcb8a2 100644 (file)
@@ -349,7 +349,7 @@ bool convert_string_talloc_handle(TALLOC_CTX *ctx, struct smb_iconv_handle *ic,
                                  size_t *converted_size)
 
 {
-       size_t i_len, o_len, destlen = (srclen * 3) / 2;
+       size_t i_len, o_len, destlen;
        size_t retval;
        const char *inbuf = (const char *)src;
        char *outbuf = NULL, *ob = NULL;
@@ -397,6 +397,15 @@ bool convert_string_talloc_handle(TALLOC_CTX *ctx, struct smb_iconv_handle *ic,
                return false;
        }
 
+       if (srclen >= SIZE_MAX / 3) {
+               DBG_ERR("convert_string_talloc: "
+                       "srclen is %zu, destlen would wrap!\n",
+                       srclen);
+               errno = EOPNOTSUPP;
+               return false;
+       }
+       destlen = srclen * 3 / 2;
+
   convert:
 
        /* +2 is for ucs2 null termination. */