util/charset/convert: do not overflow dest len

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

diff --git a/lib/util/charset/convert_string.c b/lib/util/charset/convert_string.c
index 4197065215492b76d62a250b28de879b2e17dd8c..afc8f5c4db2338ea86afebeb195416e9e2fcb8a2 100644 (file)
--- a/lib/util/charset/convert_string.c
+++ b/lib/util/charset/convert_string.c
@@ -349,7 +349,7 @@ bool convert_string_talloc_handle(TALLOC_CTX *ctx, struct smb_iconv_handle *ic,
                                  size_t *converted_size)
 
 {
                                  size_t *converted_size)
 
 {

-       size_t i_len, o_len, destlen = (srclen * 3) / 2;
+       size_t i_len, o_len, destlen;

        size_t retval;
        const char *inbuf = (const char *)src;
        char *outbuf = NULL, *ob = NULL;
        size_t retval;
        const char *inbuf = (const char *)src;
        char *outbuf = NULL, *ob = NULL;


@@ -397,6 +397,15 @@ bool convert_string_talloc_handle(TALLOC_CTX *ctx, struct smb_iconv_handle *ic,
                return false;
        }
 
                return false;
        }
 

+       if (srclen >= SIZE_MAX / 3) {
+               DBG_ERR("convert_string_talloc: "
+                       "srclen is %zu, destlen would wrap!\n",
+                       srclen);
+               errno = EOPNOTSUPP;
+               return false;
+       }
+       destlen = srclen * 3 / 2;
+

   convert:
 
        /* +2 is for ucs2 null termination. */
   convert:
 
        /* +2 is for ucs2 null termination. */