diff options
| author | Shawn Willden <swillden@google.com> | 2021-06-30 16:33:45 +0000 |
|---|---|---|
| committer | Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> | 2021-06-30 16:33:45 +0000 |
| commit | 7301ee25d29c723b341e05da57522d6727c81154 (patch) | |
| tree | b9b027af6f181031574ee05829b5fba078b01f2b | |
| parent | 2b7033bfad85c9b942411fe23e3231dad7c94c98 (diff) | |
| parent | 4907264bdcc3da0477bb5648e55c07705e2793ba (diff) | |
| download | libcppbor-7301ee25d29c723b341e05da57522d6727c81154.tar.gz | |
Check for integer overflow in cppbor::parseRecursively. am: 4907264bdc
Original change: https://googleplex-android-review.googlesource.com/c/platform/external/libcppbor/+/15110385
Change-Id: Ie9f88cfb2f561a44dd6afe7116eaced6dcef073b
| -rw-r--r-- | src/cppbor_parse.cpp | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/src/cppbor_parse.cpp b/src/cppbor_parse.cpp index f5e8fcf..964a72d 100644 --- a/src/cppbor_parse.cpp +++ b/src/cppbor_parse.cpp @@ -96,7 +96,8 @@ std::tuple<const uint8_t*, ParseClient*> handleString(uint64_t length, const uin const uint8_t* valueBegin, const uint8_t* end, const std::string& errLabel, ParseClient* parseClient) { - if (end - valueBegin < static_cast<ssize_t>(length)) { + ssize_t signed_length = static_cast<ssize_t>(length); + if (end - valueBegin < signed_length || signed_length < 0) { parseClient->error(hdrBegin, insufficientLengthString(length, end - valueBegin, errLabel)); return {hdrBegin, nullptr /* end parsing */}; } |