* xdr_array.c (xdr_array): Account for elsize when checking

	encoded array count.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@14681 dc483132-0cff-0310-8789-dd5450dbe970

diff --git a/src/lib/rpc/ChangeLog b/src/lib/rpc/ChangeLog
index b4bf706309a4df291c7f6a9ed36e63789276c821..0998bed13d9b5499f19cca87741151d96830fdbb 100644 (file)
--- a/src/lib/rpc/ChangeLog
+++ b/src/lib/rpc/ChangeLog
@@ -1,3 +1,8 @@
+2002-08-02  Tom Yu  <tlyu@mit.edu>
+
+       * xdr_array.c (xdr_array): Account for elsize when checking
+       encoded array count.
+
 2002-07-17  Ken Raeburn  <raeburn@mit.edu>
 
        * dyn.c: New file, combining contents of old util/dyn library,

diff --git a/src/lib/rpc/xdr_array.c b/src/lib/rpc/xdr_array.c
index 97c6dc73d62c53eaffb7151dc584a2d9e5abc8e3..2785368737820e4acb42f6e18d320a4612914944 100644 (file)
--- a/src/lib/rpc/xdr_array.c
+++ b/src/lib/rpc/xdr_array.c
@@ -75,7 +75,8 @@ xdr_array(xdrs, addrp, sizep, maxsize, elsize, elproc)
                return (FALSE);
        }
        c = *sizep;
-       if ((c > maxsize) && (xdrs->x_op != XDR_FREE)) {
+       if ((c > maxsize || c > LASTUNSIGNED / elsize)
+           && (xdrs->x_op != XDR_FREE)) {
                return (FALSE);
        }
        nodesize = c * elsize;