libdhcpcd: Limit messages to SSIZE_MAX

We need to add one to it for allocation to terminate it and
this is a stupidly big string anyway.

Found by LGMT.

1 files changed, 5 insertions, 0 deletions

diff --git a/src/libdhcpcd/dhcpcd.c b/src/libdhcpcd/dhcpcd.c
index c4c1f5d..f8f558b 100644
--- a/src/libdhcpcd/dhcpcd.c
+++ b/src/libdhcpcd/dhcpcd.c
@@ -903,6 +903,11 @@ dhcpcd_read_if(DHCPCD_CONNECTION *con, int fd)
 		return NULL;
 	}
 	memcpy(&len, sbuf, sizeof(len));
+	if (len >= SSIZE_MAX) {
+		/* Even this is probably too big! */
+		errno = ENOBUFS;
+		return NULL;
+	}
 	rbuf = malloc(len + 1);
 	if (rbuf == NULL)
 		return NULL;