30 lines
1.1 KiB
Diff
30 lines
1.1 KiB
Diff
From 68c6a8c1878b5294aecb04d5e27531a720b3793f Mon Sep 17 00:00:00 2001
|
|
From: akallabeth <akallabeth@posteo.net>
|
|
Date: Thu, 13 Oct 2022 08:36:26 +0200
|
|
Subject: [PATCH] Ensure urb_create_iocompletion uses size_t for calculation
|
|
|
|
(cherry picked from commit de7e0f062ee53d00b4a966a43855a716e3478150)
|
|
---
|
|
channels/urbdrc/client/data_transfer.c | 8 +++++++-
|
|
1 file changed, 7 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/channels/urbdrc/client/data_transfer.c b/channels/urbdrc/client/data_transfer.c
|
|
index 69879612692..d8725c02cf3 100644
|
|
--- a/channels/urbdrc/client/data_transfer.c
|
|
+++ b/channels/urbdrc/client/data_transfer.c
|
|
@@ -97,7 +97,13 @@ static wStream* urb_create_iocompletion(UINT32 InterfaceField, UINT32 MessageId,
|
|
UINT32 OutputBufferSize)
|
|
{
|
|
const UINT32 InterfaceId = (STREAM_ID_PROXY << 30) | (InterfaceField & 0x3FFFFFFF);
|
|
- wStream* out = Stream_New(NULL, OutputBufferSize + 28);
|
|
+
|
|
+#if UINT32_MAX >= SIZE_MAX
|
|
+ if (OutputBufferSize > UINT32_MAX - 28ull)
|
|
+ return NULL;
|
|
+#endif
|
|
+
|
|
+ wStream* out = Stream_New(NULL, OutputBufferSize + 28ull);
|
|
|
|
if (!out)
|
|
return NULL;
|