35 lines
1.1 KiB
Diff
35 lines
1.1 KiB
Diff
From 6c70b9987df7b3c2e82b88513ad6f5ebbe87065a Mon Sep 17 00:00:00 2001
|
|
From: Tim Wiederhake <twiederh@redhat.com>
|
|
Date: Thu, 22 Jul 2021 10:30:21 +0200
|
|
Subject: [PATCH 095/108] virFileReadLimFD: Cast maxlen to size_t before adding
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
If the function is called with maxlen equal to `INT_MAX`, adding
|
|
one will trigger a signed integer overflow.
|
|
|
|
Signed-off-by: Tim Wiederhake <twiederh@redhat.com>
|
|
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
|
|
(cherry picked from commit 2ed93ed979170c3310ace5cdf75a99873ba9d317)
|
|
---
|
|
src/util/virfile.c | 2 +-
|
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
|
diff --git a/src/util/virfile.c b/src/util/virfile.c
|
|
index 20260a2e58..74eae7658e 100644
|
|
--- a/src/util/virfile.c
|
|
+++ b/src/util/virfile.c
|
|
@@ -1423,7 +1423,7 @@ virFileReadLimFD(int fd, int maxlen, char **buf)
|
|
errno = EINVAL;
|
|
return -1;
|
|
}
|
|
- s = saferead_lim(fd, maxlen+1, &len);
|
|
+ s = saferead_lim(fd, (size_t) maxlen + 1, &len);
|
|
if (s == NULL)
|
|
return -1;
|
|
if (len > maxlen || (int)len != len) {
|
|
--
|
|
2.33.0
|
|
|