From f27fdd06f44f620002fb734f6c7cae47807e79c8 Mon Sep 17 00:00:00 2001 From: Tom Yu Date: Fri, 2 Aug 2002 19:28:01 +0000 Subject: [PATCH] * xdr_array.c (xdr_array): Account for elsize when checking encoded array count. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@14681 dc483132-0cff-0310-8789-dd5450dbe970 --- src/lib/rpc/ChangeLog | 5 +++++ src/lib/rpc/xdr_array.c | 3 ++- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/src/lib/rpc/ChangeLog b/src/lib/rpc/ChangeLog index b4bf70630..0998bed13 100644 --- a/src/lib/rpc/ChangeLog +++ b/src/lib/rpc/ChangeLog @@ -1,3 +1,8 @@ +2002-08-02 Tom Yu + + * xdr_array.c (xdr_array): Account for elsize when checking + encoded array count. + 2002-07-17 Ken Raeburn * dyn.c: New file, combining contents of old util/dyn library, diff --git a/src/lib/rpc/xdr_array.c b/src/lib/rpc/xdr_array.c index 97c6dc73d..278536873 100644 --- a/src/lib/rpc/xdr_array.c +++ b/src/lib/rpc/xdr_array.c @@ -75,7 +75,8 @@ xdr_array(xdrs, addrp, sizep, maxsize, elsize, elproc) return (FALSE); } c = *sizep; - if ((c > maxsize) && (xdrs->x_op != XDR_FREE)) { + if ((c > maxsize || c > LASTUNSIGNED / elsize) + && (xdrs->x_op != XDR_FREE)) { return (FALSE); } nodesize = c * elsize; -- 2.26.2