Skip to content

Commit 3386555

Browse files
TreeHunter9Artyom Ivanov
authored andcommitted
Merge commit from fork
Co-authored-by: Artyom Ivanov <artyom.ivanov@red-soft.ru>
1 parent 61c1730 commit 3386555

1 file changed

Lines changed: 7 additions & 4 deletions

File tree

src/common/classes/ClumpletReader.cpp

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -567,6 +567,8 @@ FB_SIZE_T ClumpletReader::getClumpletSize(bool wTag, bool wLength, bool wData) c
567567
return 0;
568568
}
569569

570+
const FB_UINT64 maxTotalLength = buffer_end - clumplet;
571+
570572
FB_SIZE_T rc = wTag ? 1 : 0;
571573
FB_SIZE_T lengthSize = 0;
572574
FB_SIZE_T dataSize = 0;
@@ -641,15 +643,16 @@ FB_SIZE_T ClumpletReader::getClumpletSize(bool wTag, bool wLength, bool wData) c
641643
invalid_structure("unknown clumplet type");
642644
}
643645

644-
const FB_SIZE_T total = 1 + lengthSize + dataSize;
645-
if (clumplet + total > buffer_end)
646+
// Avoid possible overflow
647+
FB_UINT64 totalLength = 1 + lengthSize + static_cast<FB_UINT64>(dataSize);
648+
if (totalLength > maxTotalLength)
646649
{
647650
invalid_structure("buffer end before end of clumplet - clumplet too long");
648-
FB_SIZE_T delta = total - (buffer_end - clumplet);
651+
FB_UINT64 delta = totalLength - maxTotalLength;
649652
if (delta > dataSize)
650653
dataSize = 0;
651654
else
652-
dataSize -= delta;
655+
dataSize -= static_cast<FB_SIZE_T>(delta);
653656
}
654657

655658
if (wLength) {

0 commit comments

Comments
 (0)