diff options
| author | Roy Marples <roy@marples.name> | 2020-06-09 19:33:23 +0100 |
|---|---|---|
| committer | Roy Marples <roy@marples.name> | 2020-06-09 19:33:23 +0100 |
| commit | aa5f136a13b2d9371e4b56e52b93fef480816e1c (patch) | |
| tree | c55bf27509c1b8d915718319982d06f2e5880774 /src/privsep-root.c | |
| parent | bc4a5e852a8b810bdbe5679ef3e03a634709d722 (diff) | |
| download | dhcpcd-aa5f136a13b2d9371e4b56e52b93fef480816e1c.tar.xz | |
privsep: limit psr_datalen to SSIZE_MAX
Diffstat (limited to 'src/privsep-root.c')
| -rw-r--r-- | src/privsep-root.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/src/privsep-root.c b/src/privsep-root.c index 8ff32303..f3fc523c 100644 --- a/src/privsep-root.c +++ b/src/privsep-root.c @@ -151,6 +151,8 @@ ps_root_mreaderrorcb(void *arg) PSR_ERROR(errno); else if ((size_t)len < sizeof(*psr_error)) PSR_ERROR(EINVAL); + else if (psr_error->psr_datalen > SSIZE_MAX) + PSR_ERROR(ENOBUFS); if (psr_error->psr_datalen != 0) { psr_ctx->psr_data = malloc(psr_error->psr_datalen); |