From: Jeremy Allison <jra@samba.org>
Date: Mon, 2 Jul 2007 20:51:09 +0000 (+0000)
Subject: r23673: Check for integer wrap on incoming data.
X-Git-Tag: samba-4.0.0alpha6~801^2~5491
X-Git-Url: http://git.samba.org/samba.git/?p=ira%2Fwip.git;a=commitdiff_plain;h=56f6f58df2bae009e10352a0435ba4d70c5cacb7

r23673: Check for integer wrap on incoming data.
Jeremy.
(This used to be commit 77a46c7aee2ad4c402527cf78e5ae70a792d65d4)
---

diff --git a/source3/lib/util_reg_api.c b/source3/lib/util_reg_api.c
index 8668bd88175..a4fb0261e31 100644
--- a/source3/lib/util_reg_api.c
+++ b/source3/lib/util_reg_api.c
@@ -80,6 +80,12 @@ WERROR registry_pull_value(TALLOC_CTX *mem_ctx,
 			tmp[num_ucs2] = 0;
 		}
 
+		if (length + 2 < length) {
+			/* Integer wrap. */
+			err = WERR_INVALID_PARAM;
+			goto error;
+		}
+
 		value->v.sz.len = convert_string_talloc(
 			value, CH_UTF16LE, CH_UNIX, tmp, length+2,
 			&value->v.sz.str, False);