mirror of https://gerrit.osmocom.org/asn1c
early detection
parent
fa8b09da92
commit
253cfcf275
|
@ -51,13 +51,14 @@ ber_fetch_length(int _is_constructed, const void *bufptr, size_t size,
|
|||
}
|
||||
|
||||
if(oct == 0) {
|
||||
ber_tlv_len_t lenplusepsilon = len + 1024;
|
||||
ber_tlv_len_t lenplusepsilon = (size_t)len + 1024;
|
||||
/*
|
||||
* Here length may be very close or equal to 2G.
|
||||
* However, the arithmetics used in some decoders
|
||||
* may add some (small) quantities to the length,
|
||||
* to check the resulting value against some limits.
|
||||
* This may result in integer wrap-around.
|
||||
* This may result in integer wrap-around, which
|
||||
* we try to avoid by checking it earlier here.
|
||||
*/
|
||||
if(lenplusepsilon < 0) {
|
||||
/* Too large length value */
|
||||
|
|
Loading…
Reference in New Issue